> For the complete documentation index, see [llms.txt](https://docs.weka.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.weka.io/kubernetes/weka-operator-deployments/weka-operator-secrets-management.md).

# Weka Operator secrets management

## Secret types and purposes

The operator creates four distinct secrets for each WekaCluster to facilitate different access requirements:

<table><thead><tr><th width="173">Secret type</th><th width="270">Format</th><th>Purpose</th></tr></thead><tbody><tr><td>Operator Secret</td><td><code>weka-operator-&#x3C;cluster-uid></code></td><td>Used by the operator for administrative operations.</td></tr><tr><td>User Admin Secret</td><td><code>weka-cluster-&#x3C;cluster-name></code></td><td>Provides access for the weka cluster with admin rights</td></tr><tr><td>Client Secret</td><td><code>weka-client-&#x3C;cluster-name></code></td><td>Used by WEKA clients to connect to the cluster with the minimum privileges required to join as a client.</td></tr><tr><td>CSI Secret</td><td><code>weka-csi-&#x3C;cluster-name></code></td><td>Used by the CSI plugin for storage provisioning.</td></tr></tbody></table>

### Configure Client Secret

WEKA clients use this secret to connect to the cluster. Use this procedure when the client and WEKA cluster run on different Kubernetes clusters.

Manual creation command:

```bash
kubectl create secret generic weka-client-<cluster-name> \
  --from-literal=username=wekaclient<cluster-uid-short> \
  --from-literal=password=<password> \
  --from-literal=org=Root \
  --from-literal=join-secret=<join-token>
```

### Configure CSI Secret

The CSI plugin requires this secret to manage and provision storage resources. It includes backend connection details:

* `endpoints`: A comma-separated list of Weka API endpoints in `<ip>:<port>` format.
* `scheme`: The API access scheme, such as https.
* `nfsTargetIps`: The IP addresses for NFS targets.

Manual creation command:

```bash
kubectl create secret generic weka-csi-<cluster-name> \
  --from-literal=username=wekacsi<cluster-uid-short> \
  --from-literal=password=<password> \
  --from-literal=organization=Root \
  --from-literal=endpoints=<ip1>:35000,<ip2>:35100 \
  --from-literal=scheme=https \
  --from-literal=nfsTargetIps=<ip>
```

***

## Usage in WekaClient resources

The method for connecting a WekaClient Custom Resource depends on how the cluster is provisioned:

1. Operator-provisioned clusters: The WekaClient automatically uses the client secret created by the operator when you specify the `targetCluster`.
2. Manual connection to non-operator clusters: When specifying `targetIPs` instead of a `targetCluster`, you must create the CSI secret manually. Ensure the secret includes a `join-secret` if the cluster requires it.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.weka.io/kubernetes/weka-operator-deployments/weka-operator-secrets-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.