# Can we integrate kubernetes .jks and .p12 based secrets to doppler?

**URL:** <https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308>\
**Category:** Need Help\
**Created:** [August 30, 2021, 6:22pm UTC](https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308 "2021-08-30T18:22:48Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![naga](https://avatars.discourse-cdn.com/v4/letter/n/7ab992/32.png) [@naga](https://community.doppler.com/u/naga)\
**Post date:** [August 30, 2021, 6:22pm UTC](https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308/1 "2021-08-30T18:22:48Z")

</div>

I am trying to do the same thing with .jks and .p12 secrets [Can we integrate kubernetes .pem and .yaml based secrets to doppler?](https://community.doppler.com/t/can-we-integrate-kubernetes-pem-and-yaml-based-secrets-to-doppler/180)  
Since if i follow the same process which i done for .PEM then the files are not converting to .jks or .p12 since i am placing base64 encoded data but it is not converting to .jks or .p12 lets say this is my secret.yaml file

 ![image](https://us1.discourse-cdn.com/flex016/uploads/doppler/original/1X/6a60e581c8db75180f2003a1a5b507fd49dab1c7.png)  
so i copied .p12 data to doppler ideally when i install the cert through yaml file this is the output which i am expecting if i integrate .p12 or .jks files integrate with doppler  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/doppler/original/1X/dcd0e6c1a2cf984ce513397aa8971b826460b171.png)  
but it is not converting to .p12 it is simply copying the data from doppler and placing in this mount file  
Can you please help me on this

---

<div class="post-metadata">

**Author:** ![ryan-blunden](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/ryan-blunden/32/9_2.png) [@ryan-blunden](https://community.doppler.com/u/ryan-blunden)\
**Post date:** [August 31, 2021, 3:49am UTC](https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308/2 "2021-08-31T03:49:02Z")

</div>

Hi @naga,

If I’m understanding correctly, you’re wanting to store the .p12 data in Doppler and supply it as a Kubernetes secret so it can be mounted as a file in a container?

If so, the process is something like the following.

Step 1. Base64 encode .p12 file and store in Doppler:

```auto
doppler secrets set ELASTIC_CERTS_P12="$(base64 -i elastic-certificates.p12)"

```

Step 2. Fetch the secret from Doppler to create the Kubernetes secret :

```auto
cat << EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: elastic-certificates
data:
  elastic-certificates.p12: $(doppler secrets get ELASTIC_CERTS_P12 --plain)
EOF

```

Step 3. Mount the secret as a file in a container:

```auto
apiVersion: v1
kind: Pod
metadata:
  name: p12-certs-test
spec:
  containers:
    - name: p12-certs
      image: ubuntu
      args:
        - sleep
        - '10000'
      volumeMounts:
      - name: certs
        mountPath: /usr/src/app/certs/
      resources:
        limits:
          cpu: 500m
          memory: 256Mi
  volumes:
    - name: certs
      secret:
        secretName: elastic-certificates

```

The .p12 file will then be mounted in the container at :

```auto
/usr/src/app/certs/elastic-certificates.p12

```

Does that solve the problem you’re facing?

---

<div class="post-metadata">

**Author:** ![naga](https://avatars.discourse-cdn.com/v4/letter/n/7ab992/32.png) [@naga](https://community.doppler.com/u/naga)\
**Post date:** [September 1, 2021, 5:20am UTC](https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308/3 "2021-09-01T05:20:25Z")

</div>

Thank you @ryan-blunden for the quick response but the issue i am facing is how i can get the data from a .p12 file i mean when i open a .p12 file it is in encrypted way when i copy the content and add as a key in doppler and install it then the pods are not starting since the data which is coming from doppler is not the .p12 data which containers are expecting so i am not sure how can can view and copy .p12 file data and integrate with doppler

---

<div class="post-metadata">

**Author:** ![ryan-blunden](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/ryan-blunden/32/9_2.png) [@ryan-blunden](https://community.doppler.com/u/ryan-blunden)\
**Post date:** [September 1, 2021, 8:22pm UTC](https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308/4 "2021-09-01T20:22:38Z")

</div>

Hi @naga,

Is the problem that a container needs to export the .p12 file to PEM format prior to starting?

Is the .p12 file mounted in the container correctly as a binary, or is the problem because it’s still base64 encoded?

Also, are you doing this manually (like in my example) or are you using our Operator?

Is this for an open source application? If so, let me know and I can hopefully put together a working example.

---

<div class="post-metadata">

**Author:** ![naga](https://avatars.discourse-cdn.com/v4/letter/n/7ab992/32.png) [@naga](https://community.doppler.com/u/naga)\
**Post date:** [September 1, 2021, 11:33pm UTC](https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308/5 "2021-09-01T23:33:57Z")

</div>

initially i tried with operator but it didn’t worked so as you suggested from above i tried manually and while when i create the secret manually this is the error i am facing

**Error from server (BadRequest): error when creating “xxx.yaml”: Secret in version “v1” cannot be handled as a Secret: v1.Secret.ObjectMeta: v1.ObjectMeta.TypeMeta: Kind: Data: decode base64: illegal base64 data at input byte 0, error found in #10 byte of …| --plain)"},“kind”:"|…, bigger context …|oppler secrets get ELASTIC\_CERTS\_P12 --plain)"},“kind”:“Secret”,“metadata”:{“name”:"elastic-cert|…**

BTW I stored the encode .p12 in doppler

This is the YAML file i am using  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/doppler/original/1X/665c06d5539f4e0d794b0726a2e532a98349dd7b.png)

This is not a open source project

---

<div class="post-metadata">

**Author:** ![ryan-blunden](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/ryan-blunden/32/9_2.png) [@ryan-blunden](https://community.doppler.com/u/ryan-blunden)\
**Post date:** [September 1, 2021, 11:48pm UTC](https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308/6 "2021-09-01T23:48:09Z")

</div>

Hi @naga,

You’re getting that error because Kubernetes is trying to parse the text `$(doppler secrets get ELASTIC_CERTS_P12 --plain)` as the actual secret value.

My example used a bash command to dynamically create the YAML file which is why it was able to insert the secret value into the YAML.

If you wanted the flow of saving the YAML file, then applying to Kubernetes, it would look like this:

Step 1. Create elastic-certificates.yaml file

```auto
cat << EOF > elastic-certificates.yaml
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: elastic-certificates
data:
  elastic-certificates.p12: $(doppler secrets get ELASTIC_CERTS_P12 --plain)
EOF

```

Step 2. Apply in Kubernetes

```auto
kubectl apply -f elastic-certificates.yaml

```

If you go this route, ensure your script also removes the created secrets YAML file.

---

<div class="post-metadata">

**Author:** ![naga](https://avatars.discourse-cdn.com/v4/letter/n/7ab992/32.png) [@naga](https://community.doppler.com/u/naga)\
**Post date:** [September 2, 2021, 12:24am UTC](https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308/7 "2021-09-02T00:24:48Z")

</div>

Thank you very much @ryan-blunden its working now, can we achieve the same thing with operator ?

---

<div class="post-metadata">

**Author:** ![ryan-blunden](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/ryan-blunden/32/9_2.png) [@ryan-blunden](https://community.doppler.com/u/ryan-blunden)\
**Post date:** [September 2, 2021, 12:30am UTC](https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308/8 "2021-09-02T00:30:15Z")

</div>

Hi @naga,

I’ve added an engineering task to the backlog for how we can potentially support already base64 encoded secrets for the Operator and will reach out once I know more.

---

<div class="post-metadata">

**Author:** ![naga](https://avatars.discourse-cdn.com/v4/letter/n/7ab992/32.png) [@naga](https://community.doppler.com/u/naga)\
**Post date:** [September 2, 2021, 12:40am UTC](https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308/10 "2021-09-02T00:40:33Z")

</div>

Thank you @ryan-blunden for the update

---

<div class="post-metadata">

**Author:** ![Nic\_Manoogian](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/nic_manoogian/32/129_2.png) [@Nic\_Manoogian](https://community.doppler.com/u/Nic_Manoogian)\
**Post date:** [September 15, 2021, 1:33pm UTC](https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308/11 "2021-09-15T13:33:30Z")

</div>

Hi @naga,

I’m excited to let you know that we just shipped a new version of the operator that has a processor for Base64: [Release v1.1.0 · DopplerHQ/kubernetes-operator · GitHub](https://github.com/DopplerHQ/kubernetes-operator/releases/tag/v1.1.0)

The Base64 processor can be used to load your Base64-formatted Doppler secrets as a binary value into your managed Kubernetes secret. You can read more on how to use this here: [kubernetes-operator/processors.md at main · DopplerHQ/kubernetes-operator · GitHub](https://github.com/DopplerHQ/kubernetes-operator/blob/main/docs/processors.md)

---

<div class="post-metadata">

**Author:** ![ryan-blunden](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/ryan-blunden/32/9_2.png) [@ryan-blunden](https://community.doppler.com/u/ryan-blunden)\
**Post date:** [September 23, 2021, 2:43am UTC](https://community.doppler.com/t/can-we-integrate-kubernetes-jks-and-p12-based-secrets-to-doppler/308/12 "2021-09-23T02:43:24Z")

</div>

Hi @naga,

I just published a tutorial for using the Kubernetes Operator to sync PKCS12 secrets.

> **[Using the Doppler Kubernetes Operator for Managing PKCS12 Certificates](https://blog.doppler.com/using-the-doppler-kubernetes-operator-for-managing-pkcs12-certificates)**
>
> This tutorial will show you how to store and automatically sync PKCS12 certificates from Doppler to Kubernetes using the Doppler Kubernetes Operator.

This uses `processors` feature of the Kubernetes Operator to avoid double base64 encoding the certificate.

Would love to get your feedback!