Migrating GKE Secrets to Secret Manager

Question

I was wondering if there are any migration guides for migrating from GKE Secrets to the Secret Manager API?

Answer 1

I'm not aware of any existing guides for doing this.

Basically, you'll need to

• recreate all of your secrets in Secret Manager
• modify your application code to use the Secrets Manager API to access the secrets
• ensure you have Workload Identity enabled for your cluster
• make sure your pod(s) use a identity with access to Secrets Manager.
• assuming everything above works, delete your existing Secrets

Answer 2

By default, data in GKE secrets is stored in Base64 encoding, which is practically the same as plaintext. GCP Secret Manager are encrypted with Google-default encryption. With Google-default encryption, secret payloads are encrypted by keys managed by Google.

See this documentation.