English | 简体中文

ACK Secret Manager allows you to use external secret management systems (e.g., Alibaba Cloud Secrets Manager to securely add secrets in Kubernetes.

ACK Secret Manager provide the same use experience as kubernetes-external-secrets which provide the same ease of use as native Secret objects and provide access to secrets stored externally. In ACK Secret Manager，it also adding an ExternalSecret object to the Kubernetes API that allows developers to inject the external secret from Alibaba Cloud Secrets Manager into a Pod using a declarative API similar to the native Secret one.

1. You are the authorized user of Alibaba Cloud Secrets Manager

2. Grant ack-secret-manager the permission of get credentials in KMS secret manager, here are two ways:

a. Attach KMS RAM policy on target worker role

• access the target cluster's detail page in Container Service console
• click the target ram role named KubernetesWorkerRole-xxxxxxxxxxxxxxx and access into RAM Roles page
• add kms RAM policy below into the policy bind to the worker role.

       {
          "Action": [
              "kms:GetSecretValue"
          ],
          "Resource": [
              "*"
          ],
          "Effect": "Allow"
      }
  

b. For ACK/ASK 1.22 clusters, fine-grained ram role for service account could be implemented via RRSA method (Note: This method only supports 1.22 version of ACK Standard and Pro clusters)

• Enable RRSA function
• Use RRSA function : including creating the corresponding RAM role for the specified serviceaccount, the trust policy for the role, and binding the permission to the role.

3. Log on to the Container Service console.

• In the left-side navigation page, choose Marketplace > App Catalog. Select the ack-secret-manager application, click it and access into application page, then modify the chart configuration values in Parameters tab, please find parameters description below
• Select the target cluster and click Create button to add the component.
• Input the customized parameters in the parameter configuration page, including rrsa.enable in values.yaml and ALICLOUD_ROLE_ARN and ALICLOUD_OIDC_PROVIDER_ARN parameters, see the configuration notes below for parameter descriptions.
• Click the OK button to complete the installation.

1. Log on to the Container Service console .
2. In the left-side navigation pane, choose Applications > Publish and click the Releases tab. On the ** Releases** tab page, locate the row that named ack-secret-manager, and click Delete.

The following table lists the configurable parameters of the ack-secret-manager chart and their default values.

Tip: You can find the ack-secret-manager release in ACK edit the param at the Parameters tab in or use the default values.yaml

Add your secret data to your Secret Manager

aliyun kms CreateSecret --SecretName test --SecretData 1234 --VersionId v1

and then create a hello-service-external-secret.yml file:

apiVersion: 'alibabacloud.com/v1alpha1'
kind: ExternalSecret
metadata:
  name: hello-service
spec:
  data:
    - key: test
      name: password
      versionStage: ACSCurrent

Save the file and run:

kubectl apply -f hello-service-external-secret.yml

Wait a few minutes and verify that the associated Secret has been created:

kubectl get secret hello-service -oyaml

The Secret created by the controller should look like:

apiVersion: v1
kind: Secret
metadata:
  name: hello-service
type: Opaque
data:
  password: MTIzNA==

If the flag disablePolling is not set to true, the controller would auto polling the secret from KMS backend with the interval set in pollingInterval