To follow along with this tutorial, click on the Import to Doppler button below to create the Doppler project containing the required variables, including the TLS certificate and key.
You can either use the Doppler dashboard to copy and paste in the contents of your certificate and key, or the Doppler CLI as per below:
doppler secrets set TLS_CERT="$(cat ./tls.cert)" doppler secrets set TLS_KEY="$(cat ./tls.key)"
Now that your TLS certificate and key are in Doppler, the next step is syncing them to a Kubernetes secret using the Doppler CLI.
We recommend using Kubernetes' built-in TLS Secret type type as it standardizes the property names inside the secret to tls.crt and tls.key:
kubectl create secret tls doppler-tls-pem \ --cert <(doppler secrets get TLS_CERT --plain) \ --key <(doppler secrets get TLS_KEY --plain)
We can see this by describing the secret:
kubectl describe secret doppler-tls-pem # >> Name: doppler-tls-pem # >> Namespace: default # >> Labels: # >> Annotations: # >> # >> Type: kubernetes.io/tls # >> # >> Data ===# >> = # >> tls.crt: 1545 bytes # >> tls.key: 1704 bytes
The below deployment mounts the TLS certificate and key inside a container.
As the mountPath is set to
/usr/src/app/secrets, the path to the certificate and key will be:
While the Doppler CLI makes it easy to sync TLS secrets, its only drawback is having to manually sync updates to the TLS secrets in Kubernetes when they're updated in Doppler.
We recommend levelling up to use our Kubernetes Operator, which instantly syncs secrets to Kubernetes when changed and includes support for auto-reloading of deployments when secrets are updated inside the cluster.
Learn more by checking out the Kubernetes Operator repository on GitHub.
Awesome work! Now you know how to use Doppler to simplify and securely manage TLS secrets in PEM format for your Kubernetes-hosted applications.