:_mod-docs-content-type: ASSEMBLY
[id="nodes-pods-secrets-store"]
= Providing sensitive data to pods by using an external secrets store
include::_attributes/common-attributes.adoc[]
:context: nodes-pods-secrets-store

toc::[]

[role="_abstract"]
As an alternative to using `secret` objects to provide sensitive information, such as passwords and user names, to applications, you can use an external secret management system to store the information. You can then use the {secrets-store-operator} to access the information and mount the secret content as a pod volume. Using an external secret store protects information that you do not want developers to have and can be more secure than `secret` objects.

// About the {secrets-store-operator}
include::modules/persistent-storage-csi-secrets-store-driver-overview.adoc[leveloffset=+1]
[role="_additional-resources"]
.Additional resources
* xref:../../storage/container_storage_interface/ephemeral-storage-csi-inline.adoc#ephemeral-storage-csi-inline[CSI inline ephemeral volumes]
* xref:../../storage/understanding-persistent-storage.adoc#understanding-persistent-storage[Understanding persistent storage]
* xref:../../storage/container_storage_interface/persistent-storage-csi.adoc#persistent-storage-csi[Configuring CSI volumes]

// Secrets store providers
include::modules/secrets-store-providers.adoc[leveloffset=+2]

// Automatic rotation
include::modules/secrets-store-auto-rotation.adoc[leveloffset=+2]

// Installing the {secrets-store-driver}
include::modules/persistent-storage-csi-secrets-store-driver-install.adoc[leveloffset=+1]

include::modules/mounting-secrets-external-secrets-store.adoc[leveloffset=+1]

// Mounting secrets from AWS Secrets Manager
:secrets-store-provider: AWS Secrets Manager
include::modules/secrets-store-aws.adoc[leveloffset=+2]

:!secrets-store-provider:

// --- START OF CONTEXT CHANGE ---
// Setting a unique context for including the secrets-store-aws.adoc module a second time in this assembly
:context: nodes-pods-secrets-store-parameter-store

// Mounting secrets from AWS Systems Manager Parameter Store
:secrets-store-provider: AWS Systems Manager Parameter Store
include::modules/secrets-store-aws.adoc[leveloffset=+2]

:!secrets-store-provider:

// Resetting the context back to original context
:context: nodes-pods-secrets-store
// --- END OF CONTEXT CHANGE ---

// Mounting secrets from Azure Key Vault
include::modules/secrets-store-azure.adoc[leveloffset=+2]

// Mounting secrets from Google Secret Manager
include::modules/secrets-store-google.adoc[leveloffset=+2]

// Mounting secrets from HashiCorp Vault
include::modules/secrets-store-vault.adoc[leveloffset=+2]

// Enabling synchronization of mounted content as Kubernetes secrets
include::modules/secrets-store-sync-secrets.adoc[leveloffset=+1]

// Viewing the status of secrets in the pod volume mount
include::modules/secrets-store-viewing-secret-versions.adoc[leveloffset=+1]

// Uninstalling the {secrets-store-operator}
include::modules/persistent-storage-csi-secrets-store-driver-uninstall.adoc[leveloffset=+1]

[role="_additional-resources"]
[id="additional-resources_{context}"]
== Additional resources

* xref:../../installing/installing_aws/ipi/installing-aws-customizations.adoc#cco-ccoctl-configuring_installing-aws-customizations[Configuring the Cloud Credential Operator utility]

* xref:../../applications/working_with_helm_charts/installing-helm.adoc#installing-helm[Installing Helm]

* link:https://access.redhat.com/third-party-software-support[Red{nbsp}Hat third-party support policy]
