This guide explains how to integrate Plane with external secret management solutions, enabling secure and centralized management of sensitive configuration data. The examples provided cover AWS Secrets Manager and HashiCorp Vault integrations, but you can adapt these patterns to your preferred secret management solution.

​
AWS Secrets Manager

  1. Create a dedicated IAM user (e.g., external-secret-access-user). You can uncheck Console Access Required.
  2. Generate ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY and keep them handy.
  3. Note the user’s ARN for later use (format: arn:aws:iam::<account-id>:user/<user-name>).
  4. Create IAM policy (e.g., external-secret-access-policy) with the following JSON: 
    {
"Version": "2012-10-17",
"Statement": [
    {
    "Effect": "Allow",
    "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
    ],
    "Resource": [
        "arn:aws:secretsmanager:<REGION>:<ACCOUNT-ID>:secret:*"
    ]
    }
]
}
    Replace <REGION> and <ACCOUNT-ID> with your AWS region and account ID.
  5. Create IAM role (e.g., external-secret-access-role) with the following trust relationship: 
    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "<IAM-USER-ARN>"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
    Replace <IAM-USER-ARN> with the ARN of the user created in step 1.
  6. Attach the AWS IAM policy created in step 4 to the IAM role.
  7. Create secrets in AWS Secrets Manager with your Plane configuration values. For example, store RabbitMQ credentials with a name like prod/secrets/rabbitmq.
    KeyValue
    RABBITMQ_DEFAULT_USERplane
    RABBITMQ_DEFAULT_PASSplane123
    Follow this pattern to manage all the environment variables in AWS Secrets Manager.
  8. Create a Kubernetes secret containing AWS credentials in your application namespace: 
    kubectl create secret generic aws-creds-secret \
--from-literal=access-key=<AWS_ACCESS_KEY_ID> \
--from-literal=secret-access-key=<AWS_SECRET_ACCESS_KEY> \
-n <application_namespace>
  9. Apply the following YAML to create a ClusterSecretStore resource: 
    apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: cluster-aws-secretsmanager
  namespace: <application_namespace>
spec:
  provider:
    aws:
      service: SecretsManager
      role: arn:aws:iam::<ACCOUNT-ID>:role/<IAM ROLE>
      region: eu-west-1
      auth:
        accessKeyIDSecretRef:
          name: aws-creds-secret
          key: access-key
        secretAccessKeySecretRef:
          name: aws-creds-secret
          key: secret-access-key
    Replace <ACCOUNT-ID> and <IAM ROLE> with your AWS account ID and the role name created in Step 5.
  10. Create an ExternalSecret resource to fetch secrets from AWS and create a corresponding Kubernetes secret: 
    apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: rabbitmq-external-secrets
  namespace: <application_namespace>
spec:
  refreshInterval: 1m
  secretStoreRef:
    name: cluster-aws-secretsmanager # ClusterSecretStore name
    kind: ClusterSecretStore
  target:
    name: rabbitmq-secret # Target Kubernetes secret name
    creationPolicy: Owner
  data:
  - secretKey: RABBITMQ_DEFAULT_USER
    remoteRef:
      key: prod/secrets/rabbitmq
      property: RABBITMQ_DEFAULT_USER
  - secretKey: RABBITMQ_DEFAULT_PASS
    remoteRef:
      key: prod/secrets/rabbitmq
Make sure to set all environment variables in the AWS Secrets Manager, and then access them via ExternalSecret resources in your Kubernetes cluster.

​
HashiCorp Vault

  1. Access the Vault UI at https://<vault-domain>/.
  2. Set up a KV secrets engine if not already configured.
  3. Create a secret with your Plane configuration values (e.g., secrets/rabbitmq_secrets). For this example, we’re setting up RabbitMQ credentials:
    KeyValue
    RABBITMQ_DEFAULT_USERplane
    RABBITMQ_DEFAULT_PASSplane123
    Follow this pattern to manage all the other environment variables in the Vault.
  4. Create a Kubernetes secret containing your Vault token in your application namespace: 
    kubectl create secret generic vault-token -n <application_namespace> --from-literal=token=<VAULT-TOKEN>
  5. Apply the following YAML to create a ClusterSecretStore resource: 
    apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: vault-backend
  namespace: <application_namespace>
spec:
  provider:
    vault:
      server: "https://<vault-domain>" # the address of your vault instance
      path: "secrets" # path for accessing the secrets
      version: "v2" # Vault API version
      auth:
        tokenSecretRef:
          name: "vault-token" # Use a k8s secret called vault-token
          key: "token" # Use this key to access the vault token
    Replace <vault-domain> with your Vault server address.
  6. Create an ExternalSecret resource to fetch secrets from Vault and create a corresponding Kubernetes secret: 
    apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: rabbitmq-external-secrets
  namespace: <application_namespace> # application-namespace
spec:
  refreshInterval: "1m"
  secretStoreRef:
    name: vault-backend # ClusterSecretStore name
    kind: ClusterSecretStore
  target:
    name: rabbitmq-secret # Target Kubernetes secret name
    creationPolicy: Owner
  data:
  - secretKey: RABBITMQ_DEFAULT_USER
    remoteRef:
      key: secrets/data/rabbitmq_secrets
      property: RABBITMQ_DEFAULT_USER
  - secretKey: RABBITMQ_DEFAULT_PASS
    remoteRef:
      key: secrets/data/rabbitmq_secrets
Follow this pattern to manage all the environment variables in the Vault, then access them via ExternalSecret resources in your Kubernetes cluster.