[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-21 (世界標準時間)。"],[[["\u003cp\u003eThis document details how to store and retrieve sensitive data within Kubernetes secrets for use in Apigee hybrid API proxies.\u003c/p\u003e\n"],["\u003cp\u003eSupported data types for Kubernetes secrets in Apigee hybrid are limited to TLS certificate and key files (\u003ccode\u003e*.crt\u003c/code\u003e, \u003ccode\u003e*.key\u003c/code\u003e, \u003ccode\u003e*.pem\u003c/code\u003e) and property files (\u003ccode\u003e*.properties\u003c/code\u003e).\u003c/p\u003e\n"],["\u003cp\u003eYou can create a Kubernetes secret using the \u003ccode\u003ekubectl create secret generic\u003c/code\u003e command, specifying the namespace, organization, environment, and file paths to be included.\u003c/p\u003e\n"],["\u003cp\u003eData stored in a Kubernetes secret can be accessed in API proxy flows through a flow variable using the format \u003ccode\u003eprivate.secret.filename.key\u003c/code\u003e, with the filename in lowercase.\u003c/p\u003e\n"],["\u003cp\u003eUpdating a Kubernetes secret requires deleting the existing secret and recreating it, as direct updates are not supported.\u003c/p\u003e\n"]]],[],null,["# Storing data in a Kubernetes secret\n\n| You are currently viewing version 1.7 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to store sensitive data in a [Kubernetes secret](https://kubernetes.io/docs/concepts/configuration/secret/) and retrieve the data from flow\nvariables in an API proxy flow.\n\nIntroduction\n------------\n\n\nThere are times when you want to store data for retrieval at runtime---non-expiring data\nthat shouldn't be hard-coded in your API proxy logic. One option is to use the\nhybrid [key-value map (KVM) feature](/apigee/docs/api-platform/cache/key-value-maps).\nIf you are already using Kubernetes\nfor secret management in a custom vault for sensitive data, you might want to consider using\nthe Kubernetes secret feature described in this topic. Just like with KVM data, you can access\nthe Kubernetes secret data in API proxy flow variables.\n\nWhat kinds of data can be stored in a Kubernetes secret?\n--------------------------------------------------------\n\n\nApigee hybrid limits you to storing the following kinds of data files in a Kubernetes secret. They\ninclude:\n\n\nProperty files are files that contain key/value pairs. For example: \n\n```text\nusername=admin\npassword=1f2d1e2e7df\n```\n\nCreating a Kubernetes secret\n----------------------------\n\nThis section explains how to create a Kubernetes secret for storing sensitive data\nin the cluster.\n| **Note:**The Kubernetes secret is environment scoped only; organization and proxy scoped secrets are not supported.\n\n1. Create the file or files that you wish to store in the Kubernetes secret. The files must be one of the supported formats with the file extensions listed in [What kinds of\n data can be stored in a Kubernetes secret](#whatkindsofdata).\n2. Execute the `kubectl create secret generic` command. For example: \n\n ```\n kubectl -n namespace create secret generic org-env-policy-secret \\\n --from-file=filepath/prop-file.properties \\\n --from-file=filepath/key-file.key \\\n --from-file=\"filepath/cert-file.pem\n ```\n\n\n Where:\n - \u003cvar translate=\"no\"\u003enamespace\u003c/var\u003e: The Kubernetes namespace where your runtime components are deployed.\n - \u003cvar translate=\"no\"\u003eorg\u003c/var\u003e: Your Apigee organization name.\n - \u003cvar translate=\"no\"\u003eenv\u003c/var\u003e: The name of an environment in your org.\n - \u003cvar translate=\"no\"\u003efilepath\u003c/var\u003e: The path to the file you wish to include in the secret. You must specify at least one file to include in the secret.\n - \u003cvar translate=\"no\"\u003eprop-file\u003c/var\u003e: The name of a properties file to include in the secret.\n - \u003cvar translate=\"no\"\u003ekey-file\u003c/var\u003e: The name of a TLS key file to include in the secret.\n - \u003cvar translate=\"no\"\u003ecert-file\u003c/var\u003e: The name of a TLS certificate file to include in the secret.\n\n\n You can include one or more files in the secret. For example: \n\n ```scdoc\n kubectl -n apigee create secret generic myorg-test-policy-secret \\\n --from-file=\"$policy_secrets_path\"/credential.properties \\\n --from-file=\"$policy_secrets_path\"/secrets.properties \\\n --from-file=\"$policy_secrets_path\"/public.key \\\n --from-file=\"$policy_secrets_path\"/fullchain.pem\n ```\n3. After creation, it may take up to 90 seconds for the change to be reflected in all the clusters. The message processors poll for secret changes every 30 seconds. If they detect a change, the cache is updated.\n\nRetrieving data from a secret\n-----------------------------\n\n\nOnce the secret is created and available (usually about 90 seconds after creation), you can\naccess the secret data in a flow variable in an API proxy flow in the organization/environment\nin which the secret is stored.\nFor example, assume your secret contains a `*.properties`\nfile called `credentials.properties`\nwith an API key in it, as follows: \n\n```text\napikey=OrxYQptBMlY1TqmiGLTtyFiaLzzrD25Z\n```\n\nYou can then retrieve the API key from a flow\nvariable using a policy like [Assign Message](/apigee/docs/api-platform/reference/policies/assign-message-policy). For example: \n\n```gdscript\n\u003cAssignMessage name=\"assignvariable-2\"\u003e\n \u003cAssignVariable\u003e\n \u003cName\u003emy-apikey\u003c/Name\u003e\n \u003cRef\u003eprivate.secret.credential.properties.apikey\u003c/Ref\u003e\n \u003c/AssignVariable\u003e\n\u003c/AssignMessage\u003e\n```\n\n\nThe variable name referenced in the `Ref` element,\n`private.secret.credential.properties.apikey`, is composed of these parts:\n\n\nIn this example, the Assign Message policy retireves the `apikey` value `OrxYQptBMlY1TqmiGLTtyFiaLzzrD25Z` and\nstores it in the flow variable `my-apikey`.\n\n### Updating a secret\n\n\nBecause `kubectl` does not support updating Kubernetes secrets, you must first\ndelete the existing secret and recreate it by following the steps in\n[Creating a Kubernetes secret](#creating-a-kubernetes-secret)."]]
