ACK Secret Manager allows you to use external secret management systems (e.g., Alibaba Cloud Secrets Manager to securely add secrets in Kubernetes.

ACK Secret Manager provide the same use experience as kubernetes-external-secrets which provide the same ease of use as native Secret objects and provide access to secrets stored externally. In ACK Secret Manager，it also adding an ExternalSecret object to the Kubernetes API that allows developers to inject the external secret from Alibaba Cloud Secrets Manager into a Pod using a declarative API similar to the native Secret one.

• Kubernetes 1.12+

1. You are the authorized user of Alibaba Cloud Secrets Manager

2. Attach KMS RAM policy on target worker role

• access the target cluster's detail page in Container Service console
• click the target ram role named KubernetesWorkerRole-xxxxxxxxxxxxxxx and access into RAM Roles page
• add kms RAM policy below into the policy bind to the worker role.

        {
           "Action": [
               "kms:GetSecretValue"
           ],
           "Resource": [
               "*"
           ],
           "Effect": "Allow"
       }

3. * Log on to the Container Service console.

• In the left-side navigation page, choose Marketplace > App Catalog. Select the ack-secret-manager application, click it and access into application page, then modify the chart configuration values in Parameters tab, please find parameters description below
• Select the target cluster and click Create button to add the component.

1. Log on to the Container Service console.
2. In the left-side navigation pane, choose Applications > Publish and click the Releases tab. On the ** Releases** tab page, locate the row that named ack-secret-manager, and click Delete.

The following table lists the configurable parameters of the ack-secret-manager chart and their default values.

Tip: You can find the ack-secret-manager release in ACK edit the param at the Parameters tab in or use the default values.yaml

Add your secret data to your Secret Manager

aliyun kms CreateSecret --SecretName test --SecretData 1234 --VersionId v1

Tip: In current Secret Manager still in public preview status, it will open to use soon, thanks for your patient.

and then create a hello-service-external-secret.yml file:

apiVersion: 'alibabacloud.com/v1alpha1'
kind: ExternalSecret
metadata:
  name: hello-service
spec:
  backendType: alicloud-kms
  data:
    - key: test
      name: password
  versionStage: ACSCurrent

Save the file and run:

kubectl apply -f hello-service-external-secret.yml

Wait a few minutes and verify that the associated Secret has been created:

kubectl get secret hello-service -oyaml

The Secret created by the controller should look like:

apiVersion: v1
kind: Secret
metadata:
  name: hello-service
type: Opaque
data:
  password: MTIzNA==

If the flag disablePolling is not set to true, the controller would auto polling the secret from KMS backend with the interval set in pollingInterval