diff --git a/docs.json b/docs.json index 79c3a40..77d90a3 100644 --- a/docs.json +++ b/docs.json @@ -52,7 +52,6 @@ "reference/auditctx", "reference/cloudaccount", "reference/domain", - "reference/external-secret-syncer", "reference/group", "reference/gvc", "reference/identity", @@ -217,6 +216,33 @@ } ] }, + { + "tab": "Template Catalog", + "groups": [ + { + "group": "Template Catalog", + "pages": [ + "template-catalog/overview", + { + "group": "Install & Manage", + "pages": [ + "template-catalog/install-manage/ui", + "template-catalog/install-manage/cli", + "template-catalog/install-manage/terraform", + "template-catalog/install-manage/pulumi" + ] + } + ] + }, + { + "group": "Templates", + "pages": [ + "template-catalog/templates/cockroachdb", + "template-catalog/templates/external-secret-syncer" + ] + } + ] + }, { "tab": "Managed Kubernetes", "groups": [ diff --git a/reference/external-secret-syncer.mdx b/reference/external-secret-syncer.mdx deleted file mode 100644 index c85691d..0000000 --- a/reference/external-secret-syncer.mdx +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: External Secret Syncer ---- - -## Overview - -The External Secret Syncer is a marketplace application that can be used to continuously sync externally-stored secrets/parameters with Control Plane secrets. If you store your secrets externally, you can use this app to automatically keep Control Plane configuration options up to date. - -## Supported External Services - -- [AWS Systems Manager Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html) -- [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) -- [Hashicorp Vault](https://www.hashicorp.com/en/products/vault) -- [1Password](https://1password.com/) -- [Doppler](https://www.doppler.com/) - -## Setup - -### Prerequisies - -1. Have a secret/parameter set up in one of the external services supported -2. Get an IAM account ready that allows to read permissions for the desired secret - -### Steps - -1. Click the `ESS` application on the Console marketplace -2. Configure the options for your external secrets. See [configuration](#configuration) -3. (optional) Add cloud access to [identity](/reference/identity) if available, instead of supplying keys in configuration. - -## Configuration - -```yaml -providers: - - name: my-vault # unique across all providers - syncInterval: 20s # override the default interval of 30s - vault: - address: https://myvault.com:6443 # required for vault - token: # required for vault - - name: my-param-store - awsParameterStore: - region: us-west-2 - endpoint: # optional - accessKeyId: # optional - secretAccessKey: # optional - - name: my-secret-manager - awsSecretManager: - region: us-west-2 - endpoint: # optional - accessKeyId: # optional - secretAccessKey: # optional - - name: my-1password - onePassword: - serviceAccountToken: # can use OP_SERVICE_ACCOUNT_TOKEN env instead - integrationName: my-ess # defaults to syncer.cpln.io - integrationVersion: v1.0.0 # defaults to ESS version - - name: my-doppler - doppler: - accessToken: -secrets: - - name: hello # creates a dictionary secret named "hello" with these key-value pairs - provider: my-vault - syncInterval: 1m # override vault specific sync interval for this secret - dictionary: - PORT: - path: /v1/secret/data/app - parse: data.port - default: 5432 - PASSWORD: - path: /v1/secret/data/app - parse: data.password - default: 'no pass' - - name: hello2 # creates an opaque secret named "hello2" containing the value of "user" key in /path/to/secret - provider: my-secret-manager - opaque: - path: /path/to/secret - parse: user - - name: hello3 # creates an opaque secret named "hello3" containing the full /path/to/secret payload - provider: my-secret-manager - opaque: /path/to/secret # stores whole aws secret (potentially JSON) in opaque secret - encoding: base64 # decode the secret from base64 to plaintext (utf-8) - - name: one-password-secret - provider: my-1password - opaque: /vault/item/password # format ///[section/] - - name: doppler-secret - provider: my-doppler - opaque: /project/config/secret # format /// -``` - - -Vault KV engine secrets look like: -``` json -{ - "data": { - "PORT": "1234" - }, - "metadata": { - "created_time": "2025-03-11T20:05:41.865209462Z", - "custom_metadata": null, - "deletion_time": "", - "destroyed": false, - "version": 1 - } -} -``` -If you use `parse`, make sure to start with `data` to get the secret content - - -## Secret - -A secret generated by ESS will look like: - -```yaml -kind: secret -name: hello -description: hello -tags: - syncer.cpln.io/lastError: '' # if ESS is experiencing an error, it will populate this tag - syncer.cpln.io/source: //gvc//workload/ -type: dictionary -data: - PORT: '1234' - PASSWORD: 'no pass' # if PASSWORD was not found in the secret, a default is used -``` diff --git a/template-catalog/install-manage/cli.mdx b/template-catalog/install-manage/cli.mdx new file mode 100644 index 0000000..e058da7 --- /dev/null +++ b/template-catalog/install-manage/cli.mdx @@ -0,0 +1,123 @@ +--- +title: Install and Manage using the CLI +sidebarTitle: CLI +--- + +## Prerequisites + + + + Install the Control Plane CLI. See [Installation](/cli-reference/installation). + + + + Install [Helm](https://helm.sh/docs/intro/install/) (v3 or later). + + + +## Install a Template + + + + Download the [template repo](https://github.com/controlplane-com/templates) and browse for the template and version you wish to deploy. + + + Create or edit a values file to customize the template for your environment. This can include settings such as resource limits, replica counts, and any template-specific options. + + Your values file must follow the same structure and format as the template's default values file. + + + + Run the following command to install the template as a release: + + ```bash +cpln helm install