--- title: "Fortanix DSM with External Secret Operator" slug: "fortanix-dsm-with-external-secret-operator" updated: 2026-07-24T17:41:50Z published: 2026-07-24T17:41:50Z canonical: "support.fortanix.com/fortanix-dsm-with-external-secret-operator" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Fortanix DSM with External Secret Operator ## 1.0 Introduction This article describes how to integrate **Fortanix Data Security Manager (DSM)** with **External Secrets Operator (ESO)** to securely manage and retrieve secrets for Kubernetes workloads. By using the Fortanix provider with ESO, you can store secrets centrally in Fortanix DSM and automatically synchronize them with Kubernetes Secret objects, ensuring strong protection and lifecycle management of sensitive data. ## 2.0 Prerequisites Ensure the following: - Fortanix DSM must be accessible. *For more information, refer to* [*Section 5.1: Signing Up*](/v1/docs/using-data-security-manager-with-external-secret-operator#51-signing-up) *and* [*Section 5.2: Creating an Account*](/v1/docs/using-data-security-manager-with-external-secret-operator#52-creating-an-account)*.* - Access to a running Kubernetes cluster (version 1.25 or later). - ESO is installed in the cluster. *For more information, refer to the following:* - *To learn about the tools required for installing ESO, refer to the* [*ESO official documentation*](https://external-secrets.io/latest/introduction/prerequisites/)*.* - *To learn about the step-by-step procedure for installing ESO, refer to the* [*ESO official documentation*](https://external-secrets.io/v0.4.4/guides-getting-started/)*.* ## 3.0 Product Version Tested The following product versions were tested: - Fortanix DSM version 5.2 or later - External Secrets Operator (ESO) version 0.9 or later - Kubernetes version 1.25 or later ## 4.0 Architecture Workflow ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM and ESO diagram.png) **Figure 1: Architecture diagram** This figure illustrates the high-level workflow of the integration between **Fortanix DSM** and the **ESO** for Kubernetes. The ESO acts as an intermediary that fetches secrets from external secret managers such as Fortanix DSM and injects them into Kubernetes Secrets. 1. **ExternalSecretsObject** – Specifies which external secret to fetch, from which provider (such as Fortanix DSM), and how often to synchronize it. 2. **SecretStore** – Defines the provider connection details and authentication method. In this case, it stores the Fortanix DSM API URL and API key credentials used by ESO. 3. **External Secrets Operator** – Authenticates using the configured service account and securely connects to Fortanix DSM to retrieve secret values. 4. **Sync Process** – The operator periodically fetches the secret values from Fortanix DSM based on the refresh interval defined in the ExternalSecretsObject. 5. **Kubernetes Secret Creation** – ESO creates or updates a native Kubernetes Secret with the retrieved data, making it available to pods and workloads in the specified namespace. 6. **Secrets Manager (Fortanix DSM)** – Serves as the external secret source that securely stores and manages sensitive information such as API keys, credentials, and certificates. ESO retrieves these secrets from Fortanix DSM through the configured SecretStore connection, ensuring they remain synchronized and available as native Kubernetes Secrets for use by applications and workloads. ## 5.0 Configure Fortanix DSM A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections: ### 5.1 Signing Up To get started with the Fortanix DSM cloud service, you must register an account at . For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region. *For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.* ### 5.2 Creating an Account Access in a web browser and enter your credentials to log in to Fortanix DSM. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png) **Figure 2: Logging in** *For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.* ### 5.3 Creating a Group Perform the following steps to create a group in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(77).png) **Figure 3: Add groups** 2. On the **Adding new group** page: 1. **Title**: Enter a name for your group. 2. **Description** (optional): Enter a short description of the group. 3. Click **SAVE** to create the new group. *For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.* > [!NOTE] > TIP > > It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.* ### 5.4 Creating an Application Perform the following steps to create an application (app) in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(76).png) **Figure 4: Add application** 2. On the **Adding new app** page: 1. **App name**: Enter the name for your application. 2. **ADD DESCRIPTION** (optional): Enter a short description of the application. 3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.* 4. **Assigning the new app to groups**: Select the group created in [*Section 5.3: Creating a Group*](/v1/docs/using-data-security-manager-with-external-secret-operator#53-creating-a-group)[](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list. 3. Click **SAVE** to add the new application. *For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.* ### 5.5 Copying the API Key Perform the following steps to copy the API key from the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in the previous section[](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application) to go to the detailed view of the app. 2. On the **INFO** tab, click **VIEW API KEY DETAILS**. 3. From the **API Key Details** dialog box, copy the **API Key** of the app to use it later. ### 5.6 Creating a Security Object You can either **IMPORT** or **GENERATE** any security object type in Fortanix DSM. For example, this integration demonstrates **importing a SECRET** type of security object. Perform the following steps to generate a secret key in the Fortanix DSM: 1. In the DSM left navigation panel, click the**Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-SO(33).png) **Figure 5: Add Security Object** 2. On the **Add new Security Object** page: 1. **Security Object Name**: Enter the name of your security object. 2. **Group**: Select the group as created in [*Section 5.3: Creating a Group*](/v1/docs/using-data-security-manager-with-external-secret-operator#53-creating-a-group). 3. Select **IMPORT**. 4. In the **Choose a type** section,select the **SECRET** key type. 5. In the **Place value here or import from file** section, select the value format type as required, such as **Text (UTF-8)**, **Hex**, **Base64**, or **Raw**,and click **UPLOAD A FILE** to upload the key file. 6. In the **Key operations permitted** section, select the required operations to define the actions that can be performed with the cryptographic keys, such as encryption, decryption, signing, and verifying. 3. Click **IMPORT** to create the new security object. *For more information about security objects, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#60-security-objects)*.* ## 6.0 Create a Namespace in Kubernetes Run the following command to create a Kubernetes namespace for the ESO: ```bash kubectl create namespace ``` Where, `<namespace>` is the Kubernetes namespace in which you want to deploy the External Secrets Operator resources. ## 7.0 Create the Fortanix API Key Store Run the following command to create a Kubernetes Secret that stores the Fortanix DSM API key used by the ESO provider: ```bash kubectl -n create secret generic \ --from-literal=sdkms-api-key-='' ``` Where, - `<namespace>`: Refers to the Kubernetes namespace created in [*Section 6.0: Creating a Namespace in Kubernetes*](/v1/docs/using-data-security-manager-with-external-secret-operator#60-creating-a-namespace-in-kubernetes). - `<api-key-secret-name>`: Refers to the name of the Kubernetes Secret that stores the Fortanix DSM API key. - `<api-key-value>`: Refers to the actual Fortanix DSM app API key obtained in [*Section 5.5: Copying an API Key*](/v1/docs/using-data-security-manager-with-external-secret-operator#55-copying-the-api-key). ## 8.0 Create the SecretStore File Create a SecretStore file to establish the connection between ESO and Fortanix DSM and update it with the following content: ```bash apiVersion: external-secrets.io/v1 kind: SecretStore metadata:  name:  namespace: spec:  provider:    fortanix:      apiUrl: ""  # Replace with your DSM endpoint URL      apiKey:        secretRef:          name:          key: ``` Where, - `<secretstore-name>`: Refers to the name of the SecretStore resource. - `<namespace>`: Refers to the Kubernetes namespace created in [*Section 6.0: Creating a Namespace in Kubernetes*](/v1/docs/using-data-security-manager-with-external-secret-operator#60-creating-a-namespace-in-kubernetes). - `<dsm-endpoint>`: Refers to the Fortanix DSM endpoint URL. - `<api-key-secret-name>`: Refers to the name of the Kubernetes Secret created in [*Section 7.0: Creating the Fortanix API Key Store*](/v1/docs/using-data-security-manager-with-external-secret-operator#70-creating-the-fortanix-api-key-store), which stores the DSM API key. - `<api-key-name>`: Refers to the key name defined inside the Kubernetes Secret that holds the Fortanix DSM API key, as created in [*Section 5.6: Creating a Security Object*](/v1/docs/using-data-security-manager-with-external-secret-operator#56-creating-a-security-object). Run the following command to apply the configuration: ```bash kubectl apply -f .yaml ``` Where, `<secretstore-filename>` is the YAML file name created in the previous step. ## 9.0 Create the External Secret File Create an ExternalSecret file to configure Kubernetes to retrieve secrets from Fortanix DSM and create corresponding Kubernetes Secrets, and update it with the following content: ```bash apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata:  name:  namespace: spec:  refreshInterval: 1h  secretStoreRef:    name:    kind: SecretStore  target:    name:    creationPolicy: Owner  data:    - secretKey:      remoteRef:        key: ""  # Replace with the DSM secret name ``` Where, - `<external-secret-name>`: Refers to the name of the ExternalSecret resource. - `<namespace>`: Refers to the Kubernetes namespace created in [*Section 6.0: Creating a Namespace in Kubernetes*](/v1/docs/using-data-security-manager-with-external-secret-operator#60-creating-a-namespace-in-kubernetes). - `<secretstore-name>`: Refers to the SecretStore resource created in [*Section 8.0: Creating the SecretStore*](/v1/docs/using-data-security-manager-with-external-secret-operator#80-creating-the-secretstore-file). - `<k8s-secret-name>`: Refers to the name of the Kubernetes Secret that will be created or updated. - `<local-secret-key>`: Refers to the key name within the Kubernetes Secret that maps to the secret value retrieved from Fortanix DSM. - `<dsm-secret-name>`: Refers to the name of the secret created in Fortanix DSM, as described in [*Section 5.6: Creating a Security Object*](/v1/docs/using-data-security-manager-with-external-secret-operator#56-creating-a-security-object). Run the following command to apply the configuration: ```bash kubectl apply -f .yaml ``` Where, `<externalsecret-filename>` is the YAML file name that contains the ExternalSecret configuration created in the previous step. ## 10.0 Verify the Integration Perform the following commands to verify successful integration between Fortanix DSM and ESO. 1. Run the following command to check the status of the ExternalSecret: ```bash kubectl -n get externalsecret kubectl -n describe externalsecret ``` 2. Run the following command to check if the Kubernetes Secret was created: ```bash kubectl -n get secret ``` 3. Run the following command to view and decode the secret value: ```bash kubectl -n get secret -o jsonpath='{.data.}' | base64 -d ```