# Does doppler support the secret of type kubernetes.io/tls? **URL:** \ **Category:** Feature Requests\ **Created:** [December 16, 2021, 4:53pm UTC](https://community.doppler.com/t/does-doppler-support-the-secret-of-type-kubernetes-io-tls/457 "2021-12-16T16:53:52Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![rahul\_mohan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/rahul_mohan/32/309_2.png) [@rahul\_mohan](https://community.doppler.com/u/rahul_mohan)\ **Post date:** [December 16, 2021, 4:53pm UTC](https://community.doppler.com/t/does-doppler-support-the-secret-of-type-kubernetes-io-tls/457/1 "2021-12-16T16:53:52Z")
Hi all, We are looking for a solution for Kubernetes TLS secret with auto-sync using Doppler Operator. This link [kubernetes.io/tls](https://blog.doppler.com/kubernetes-tls-pem-certificates) does not help as the managed secret is of type opaque and it has no way to have the keys like tls.cert and tls.key This makes the update of the tls cert manual. Is there any pan to support this? Best regards, ---
**Author:** ![watsonian](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/watsonian/32/267_2.png) [@watsonian](https://community.doppler.com/u/watsonian)\ **Post date:** [December 16, 2021, 5:15pm UTC](https://community.doppler.com/t/does-doppler-support-the-secret-of-type-kubernetes-io-tls/457/2 "2021-12-16T17:15:01Z")
Hi Rahul, Welcome to the Doppler Community! Doppler definitely supports Kubernetes TLS secrets via the Doppler Operator! What you’re looking for here are [Processors](https://docs.doppler.com/docs/kubernetes-operator#processors). That will allow you to specify whether the secret is already base64 encoded or in plain text, which should let you use PKCS12 certificates without issue. We have a guide showing how to do that here: > **[Using the Doppler Kubernetes Operator for Managing PKCS12 Certificates](https://blog.doppler.com/using-the-doppler-kubernetes-operator-for-managing-pkcs12-certificates)** > > This tutorial will show you how to store and automatically sync PKCS12 certificates from Doppler to Kubernetes using the Doppler Kubernetes Operator. Give those a look and let me know if they’re what you were after! Thanks, -Joel ---
**Author:** ![watsonian](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/watsonian/32/267_2.png) [@watsonian](https://community.doppler.com/u/watsonian)\ **Post date:** [December 16, 2021, 5:20pm UTC](https://community.doppler.com/t/does-doppler-support-the-secret-of-type-kubernetes-io-tls/457/3 "2021-12-16T17:20:39Z")
Hi again! Actually, I just realized that wasn’t specifically what you’re after (although it should still let you sync certificates via the Operator, it won’t do so as a [kubernetes.io/tls](http://kubernetes.io/tls) secret). You CAN use Doppler to create those, but I believe it’s only supported when done manually as shown here: > **[Using Doppler for Managing Kubernetes TLS/SSL Certificates Secrets in PEM Format](https://blog.doppler.com/kubernetes-tls-pem-certificates)** > > Learn how simple managing TLS Certificates in PEM format for Kubernetes hosted applications can be when combined with the Doppler CLI. I’ll do some more investigating to see if there’s a way to get the Operator to create TLS secrets and will get back to you! -Joel ---
**Author:** ![watsonian](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/watsonian/32/267_2.png) [@watsonian](https://community.doppler.com/u/watsonian)\ **Post date:** [December 16, 2021, 5:29pm UTC](https://community.doppler.com/t/does-doppler-support-the-secret-of-type-kubernetes-io-tls/457/4 "2021-12-16T17:29:01Z")
After looking into this quickly, it doesn’t appear as though the Operator has any special handling available for TLS certificates. That said, the `kubernetes.io/tls` secret type is just a convenience shortcut that creates an Opaque secret with a `tls.cert` and `tls.key` entry. There’s no functional difference between using one of those and having an Opaque secret containing the values directly as would happen when using the Operator (with the base64 processor if you’re using a certificate in PKCS12 format. -Joel ---
**Author:** ![rahul\_mohan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/rahul_mohan/32/309_2.png) [@rahul\_mohan](https://community.doppler.com/u/rahul_mohan)\ **Post date:** [December 17, 2021, 7:51am UTC](https://community.doppler.com/t/does-doppler-support-the-secret-of-type-kubernetes-io-tls/457/5 "2021-12-17T07:51:35Z")
Hello, thanks for answering. I would still not be able to have the keys as tls.cert and tls.key in the doppler. It would not allow me for it. So, even for an opaque secret, it may not be useful for me if I am looking for a secret with keys tls.cert and tls.key This leaves me to the manual process of updating the secret every time it changes in the Doppler. I may not have the auto-sync facility using the Operator as the keys are of different formats. I would love to see this feature support of tls with doppler. It would ease my tls secret update across multiple environments. let’s say we could create the keys as TLS\_CERT and TLS\_KEY (or any custom name adherent to your secret naming convention) in the Doppler Project. Doppler Secret would have the mapping section in the “managedSecret” part along with the secret output type. Mapping would contain the source key and destination key (TLS\_CERT to tls.cert sort of) and secret output type as “[kubernetes.io/tls](http://kubernetes.io/tls) or opaque as default”. This would just make the tls management across the environment so much easier with this yearly update of SSL certs. regards, Rahul ---
**Author:** ![watsonian](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/watsonian/32/267_2.png) [@watsonian](https://community.doppler.com/u/watsonian)\ **Post date:** [January 14, 2022, 5:19pm UTC](https://community.doppler.com/t/does-doppler-support-the-secret-of-type-kubernetes-io-tls/457/6 "2022-01-14T17:19:37Z")
Hi @rahul_mohan! Sorry for the long delay getting back to you! I missed your post in my notifications somehow. Yeah, I see where you’re coming from. We’ve discussed the idea of adding the capability of renaming secrets during syncs in a way that would let you accomplish what you’re after. Right now, I’m afraid adding it isn’t really on our roadmap, so I can’t say when that kind of functionality might make it into Doppler. For now, your only real options are to either update your tooling to look for `TLS_CERT` and `TLS_KEY` entries in the secret or manually update, as you mentioned. Sorry that we don’t have something better for you right now! Thanks, -Joel ---
**Author:** ![ryan-blunden](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/ryan-blunden/32/9_2.png) [@ryan-blunden](https://community.doppler.com/u/ryan-blunden)\ **Post date:** [January 19, 2022, 1:50am UTC](https://community.doppler.com/t/does-doppler-support-the-secret-of-type-kubernetes-io-tls/457/7 "2022-01-19T01:50:52Z")
Hi @rahul_mohan, Hope the yearly updating of your TLS certs went well! I wanted to ask, how important is it that the secret created would be of type `kubernetes.io/tls`, as opposed to being an Opaque secret with the `tls.cert` and `tls.key` keys? And when it comes to managing the TLS certificate and key in Doppler, are they in their own isolated project or environment or stored alongside an application’s secrets? ---
**Author:** ![watsonian](https://sea2.discourse-cdn.com/flex016/user_avatar/community.doppler.com/watsonian/32/267_2.png) [@watsonian](https://community.doppler.com/u/watsonian)\ **Post date:** [August 15, 2023, 5:46pm UTC](https://community.doppler.com/t/does-doppler-support-the-secret-of-type-kubernetes-io-tls/457/8 "2023-08-15T17:46:39Z")
Hi @rahul_mohan, I wanted to post an update here noting that we’ve added support for `kubernetes.io/tls` secret types! You can get this in `v1.4.0` of our operator (you’ll need to be sure you update the CRD as well since the Helm update won’t do that automatically). More information about how this works is available here: > Let me know if you have any questions! Regards, -Joel