[[["์ดํดํ๊ธฐ ์ฌ์","easyToUnderstand","thumb-up"],["๋ฌธ์ ๊ฐ ํด๊ฒฐ๋จ","solvedMyProblem","thumb-up"],["๊ธฐํ","otherUp","thumb-up"]],[["์ดํดํ๊ธฐ ์ด๋ ค์","hardToUnderstand","thumb-down"],["์๋ชป๋ ์ ๋ณด ๋๋ ์ํ ์ฝ๋","incorrectInformationOrSampleCode","thumb-down"],["ํ์ํ ์ ๋ณด/์ํ์ด ์์","missingTheInformationSamplesINeed","thumb-down"],["๋ฒ์ญ ๋ฌธ์ ","translationIssue","thumb-down"],["๊ธฐํ","otherDown","thumb-down"]],["์ต์ข ์ ๋ฐ์ดํธ: 2025-08-30(UTC)"],[[["\u003cp\u003eThis document details the process of storing sensitive data in Kubernetes secrets for use within API proxy flows, using Kubernetes instead of the key-value map (KVM).\u003c/p\u003e\n"],["\u003cp\u003eOnly TLS certificate/key files (\u003ccode\u003e*.crt\u003c/code\u003e, \u003ccode\u003e*.key\u003c/code\u003e, \u003ccode\u003e*.pem\u003c/code\u003e) and property files (\u003ccode\u003e*.properties\u003c/code\u003e) can be stored in a Kubernetes secret in Apigee hybrid.\u003c/p\u003e\n"],["\u003cp\u003eCreating a Kubernetes secret involves using the \u003ccode\u003ekubectl create secret generic\u003c/code\u003e command, specifying the namespace, organization, environment, and file paths to be included.\u003c/p\u003e\n"],["\u003cp\u003eOnce created, secret data can be accessed in an API proxy flow variable using the format \u003ccode\u003eprivate.secret.[filename].[key]\u003c/code\u003e, where \u003ccode\u003efilename\u003c/code\u003e is the lowercase name of a file within the secret and \u003ccode\u003ekey\u003c/code\u003e is the key in the property file.\u003c/p\u003e\n"],["\u003cp\u003eUpdating an existing Kubernetes secret requires deleting the old secret and then recreating it with the desired changes, as direct updates are not supported by \u003ccode\u003ekubectl\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Storing data in a Kubernetes secret\n\n| You are currently viewing version 1.14 of the Apigee hybrid documentation. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to store sensitive data in a [Kubernetes secret](https://kubernetes.io/docs/concepts/configuration/secret/) and retrieve the data from flow\nvariables in an API proxy flow.\n\nIntroduction\n------------\n\n\nThere are times when you want to store data for retrieval at runtime---non-expiring data\nthat shouldn't be hard-coded in your API proxy logic. One option is to use the\nhybrid [key-value map (KVM) feature](/apigee/docs/api-platform/cache/key-value-maps).\nIf you are already using Kubernetes\nfor secret management in a custom vault for sensitive data, you might want to consider using\nthe Kubernetes secret feature described in this topic. Just like with KVM data, you can access\nthe Kubernetes secret data in API proxy flow variables.\n\nWhat kinds of data can be stored in a Kubernetes secret?\n--------------------------------------------------------\n\n\nApigee hybrid limits you to storing the following kinds of data files in a Kubernetes secret. They\ninclude:\n\n\nProperty files are files that contain key/value pairs. For example: \n\n```text\nusername=admin\npassword=1f2d1e2e7df\n```\n\nCreating a Kubernetes secret\n----------------------------\n\nThis section explains how to create a Kubernetes secret for storing sensitive data\nin the cluster.\n| **Note:**The Kubernetes secret is environment scoped only; organization and proxy scoped secrets are not supported.\n\n1. Create the file or files that you wish to store in the Kubernetes secret. The files must be one of the supported formats with the file extensions listed in [What kinds of\n data can be stored in a Kubernetes secret](#whatkindsofdata).\n2. Execute the `kubectl create secret generic` command. For example: \n\n ```\n kubectl -n namespace create secret generic org-env-policy-secret \\\n --from-file=filepath/prop-file.properties \\\n --from-file=filepath/key-file.key \\\n --from-file=\"filepath/cert-file.pem\n ```\n\n\n Where:\n - \u003cvar translate=\"no\"\u003enamespace\u003c/var\u003e: The Kubernetes namespace where your runtime components are deployed.\n - \u003cvar translate=\"no\"\u003eorg\u003c/var\u003e: Your Apigee organization name.\n - \u003cvar translate=\"no\"\u003eenv\u003c/var\u003e: The name of an environment in your org.\n - \u003cvar translate=\"no\"\u003efilepath\u003c/var\u003e: The path to the file you wish to include in the secret. You must specify at least one file to include in the secret.\n - \u003cvar translate=\"no\"\u003eprop-file\u003c/var\u003e: The name of a properties file to include in the secret.\n - \u003cvar translate=\"no\"\u003ekey-file\u003c/var\u003e: The name of a TLS key file to include in the secret.\n - \u003cvar translate=\"no\"\u003ecert-file\u003c/var\u003e: The name of a TLS certificate file to include in the secret.\n\n\n You can include one or more files in the secret. For example: \n\n ```scdoc\n kubectl -n apigee create secret generic myorg-test-policy-secret \\\n --from-file=\"$policy_secrets_path\"/credential.properties \\\n --from-file=\"$policy_secrets_path\"/secrets.properties \\\n --from-file=\"$policy_secrets_path\"/public.key \\\n --from-file=\"$policy_secrets_path\"/fullchain.pem\n ```\n3. After creation, it may take up to 90 seconds for the change to be reflected in all the clusters. The message processors poll for secret changes every 30 seconds. If they detect a change, the cache is updated.\n\nRetrieving data from a secret\n-----------------------------\n\n\nOnce the secret is created and available (usually about 90 seconds after creation), you can\naccess the secret data in a flow variable in an API proxy flow in the organization/environment\nin which the secret is stored.\nFor example, assume your secret contains a `*.properties`\nfile called `credentials.properties`\nwith an API key in it, as follows: \n\n```text\napikey=OrxYQptBMlY1TqmiGLTtyFiaLzzrD25Z\n```\n\nYou can then retrieve the API key from a flow\nvariable using a policy like [Assign Message](/apigee/docs/api-platform/reference/policies/assign-message-policy). For example: \n\n```gdscript\n\u003cAssignMessage name=\"assignvariable-2\"\u003e\n \u003cAssignVariable\u003e\n \u003cName\u003emy-apikey\u003c/Name\u003e\n \u003cRef\u003eprivate.secret.credential.properties.apikey\u003c/Ref\u003e\n \u003c/AssignVariable\u003e\n\u003c/AssignMessage\u003e\n```\n\n\nThe variable name referenced in the `Ref` element,\n`private.secret.credential.properties.apikey`, is composed of these parts:\n\n\nIn this example, the Assign Message policy retireves the `apikey` value `OrxYQptBMlY1TqmiGLTtyFiaLzzrD25Z` and\nstores it in the flow variable `my-apikey`.\n\n### Updating a secret\n\n\nBecause `kubectl` does not support updating Kubernetes secrets, you must first\ndelete the existing secret and recreate it by following the steps in\n[Creating a Kubernetes secret](#creating-a-kubernetes-secret)."]]
