Container Service for Kubernetes:Import Alibaba Cloud KMS service credentials by using ack-secret-manager

Configure permissions for Account A

1. Use Account A to create a RAM role with Account B as the trusted entity. Select Other Account and enter the ID of Account B. For details, see Create a RAM role for a trusted Alibaba Cloud account.

2. Create a custom RAM policy that grants access to KMS secrets:

   {
       "Action": [
          "kms:GetSecretValue",
          "kms:Decrypt"
       ],
       "Resource": [
           "*"
       ],
       "Effect": "Allow"
   }

3. Attach the policy to the RAM role. For details, see Grant permissions to a RAM role.

Configure permissions for Account B

1. Enable RRSA for the ACK cluster in the ACK console. When installing ack-secret-manager, set rrsa.enable to true. For details, see Enable RRSA.

2. Create a RAM role in Account B with the OIDC IdP as the trusted entity. Set Principal Type to Identity Provider and configure the following parameters. For details, see Create a RAM role for an OIDC IdP.

   Parameter	Value
   Identity provider type	Select OIDC
   Identity provider	Select ack-rrsa-<cluster_id>, where <cluster_id> is your cluster ID
   Condition — oidc:iss	Keep the default
   Condition — oidc:aud	Keep the default
   Condition — oidc:sub	Add manually: Key = oidc:sub, Operator = StringEquals, Value = system:serviceaccount:kube-system:ack-secret-manager

3. Create a custom RAM policy in Account B that allows assuming the RAM role in Account A, then attach it to the Account B RAM role.

   1. Create a policy with the following content. Replace <account-id> with the ID of Account A and <role-name> with the RAM role created in Account A. For details on finding the ARN, see How do I view the ARN of a RAM role?

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Resource": "acs:ram:*:<account-id>:role/<role-name>"
          }
        ],
        "Version": "1"
      }

   2. Attach the policy to the RAM role created in Account B.

4. Create a SecretStore for cross-account access.

   1. Create a file named secretstore-ramrole.yaml with the following content. Replace the placeholders as described.

      Placeholder	Description
      {ACK-accountID}	ID of Account B (the account with the ACK cluster)
      {clusterID}	ID of your ACK cluster
      {ACK-roleName}	Name of the RAM role created in Account B
      {KMS-accountID}	ID of Account A (the account with the KMS instance)
      {KMS-roleName}	Name of the RAM role created in Account A
      {roleSessionName}	Role session name — any custom string

      apiVersion: 'alibabacloud.com/v1alpha1'
      kind: SecretStore
      metadata:
        name: scdemo-cross-account
      spec:
        KMS:
          KMSAuth:
            oidcProviderARN: "acs:ram::{ACK-accountID}:oidc-provider/ack-rrsa-{clusterID}"
            ramRoleARN: "acs:ram::{ACK-accountID}:role/{ACK-roleName}"
            remoteRamRoleARN: "acs:ram::{KMS-accountID}:role/{KMS-roleName}"
            remoteRamRoleSessionName: {roleSessionName}

5. Create an ExternalSecret to specify the sync details. For details, see Step 3: Sync KMS secrets to the cluster.

Extract specific fields from a JSON secret

Use jmesPath to extract specific key-value pairs from a KMS secret stored in JSON format.

For example, given the following JSON secret stored in KMS Secrets Manager:

{"name":"tom","friends":[{"name":"lily"},{"name":"mark"}]}

Create an ExternalSecret with jmesPath to extract specific fields:

• path: JMESPath expression to extract the field. Required. See the JMESPath specification.

• objectAlias: Key name in the resulting Kubernetes Secret.

apiVersion: 'alibabacloud.com/v1alpha1'
kind: ExternalSecret
metadata:
  name: es-json-demo
spec:
  provider: kms
  data:
    - key: {KMS secret name}
      versionStage: {KMS secret version stage}
      secretStoreRef:
        name: {secret store name}
        namespace: {secret store namespace}
      jmesPath:
        - path: "name"              # Extracts: "tom"
          objectAlias: "myname"
        - path: "friends[0].name"   # Extracts: "lily"
          objectAlias: "friendname"

Auto-parse a JSON secret

If the JSON structure is unknown or variable, use dataProcess.extract to automatically parse all key-value pairs from a JSON secret. Use dataProcess.replaceRule to rename keys that don't conform to Kubernetes Secret key naming requirements.

For example, given the following JSON secret with non-conforming key names:

{"/name-invalid":"lily","name-invalid/":[{"name":"mark"}]}

apiVersion: 'alibabacloud.com/v1alpha1'
kind: ExternalSecret
metadata:
  name: extract-secret
spec:
  provider: kms
  dataProcess:
    - extract:
        key: {KMS secret name}
        versionStage: ACSCurrent
        secretStoreRef:
          name: {secret store name}
          namespace: {secret store namespace}
      replaceRule:
        - source: "^/.*d$"   # Keys starting with / and ending with d -> "tom"
          target: "tom"
        - source: "^n.*/$"   # Keys starting with n and ending with / -> "mark"
          target: "mark"

Extract specific fields from a YAML secret

Use jmesPath to extract specific key-value pairs from a KMS secret stored in YAML format.

For example, given the following YAML secret stored in KMS Secrets Manager:

name: tom
friends:
  - name: lily
  - name: mark

apiVersion: 'alibabacloud.com/v1alpha1'
kind: ExternalSecret
metadata:
  name: es-yaml-demo
spec:
  provider: kms
  data:
    - key: {KMS secret name}
      versionStage: {KMS secret version stage}
      secretStoreRef:
        name: {secret store name}
        namespace: {secret store namespace}
      jmesPath:
        - path: "name"              # Extracts: "tom"
          objectAlias: "myname"
        - path: "friends[0].name"   # Extracts: "lily"
          objectAlias: "friendname"

Auto-parse a YAML secret

If the YAML structure is unknown or variable, use dataProcess.extract to auto-parse all key-value pairs. Use dataProcess.replaceRule to handle non-conforming key names.

For example, given the following YAML secret:

/name-invalid: lily
name-invalid/:
  - name: mark

apiVersion: 'alibabacloud.com/v1alpha1'
kind: ExternalSecret
metadata:
  name: extract-secret
spec:
  provider: kms
  dataProcess:
    - extract:
        key: {KMS secret name}
        versionStage: ACSCurrent
        secretStoreRef:
          name: {secret store name}
          namespace: {secret store namespace}
      replaceRule:
        - source: "^/.*d$"   # Keys starting with / and ending with d -> "tom"
          target: "tom"
        - source: "^n.*/$"   # Keys starting with n and ending with / -> "mark"
          target: "mark"