Container Service for Kubernetes:Use ack-secret-manager to import Alibaba Cloud OOS encryption parameters

How it works

ack-secret-manager uses two custom resource definitions (CRDs):

• SecretStore — defines *how* ack-secret-manager authenticates with OOS (authorization config)

• ExternalSecret — defines *what* to sync (which OOS parameter maps to which Kubernetes Secret key)

The component polls OOS on a configurable interval, writes the latest parameter value into a Kubernetes Secret, and keeps it in sync automatically. The resulting Kubernetes Secret has the same name and namespace as the ExternalSecret.

Security notes

Before enabling secret synchronization, assess the following risks:

• File system exposure: When Secrets are mounted as files, a CVE (Common Vulnerabilities and Exposures) exploit in an application can allow directory traversal and leak the secrets.

• Environment variable exposure: Misconfigured debug breakpoints or log permissions can expose secrets referenced as environment variables. Avoid this pattern.

• Least privilege: Apply the least privilege principle when granting sync permissions. RRSA (RAM Roles for Service Accounts) enforces per-pod isolation — other pods cannot access secrets unless explicitly associated with the same RAM role.

For workloads that don't need to persist secrets, use RRSA to authorize pods and call the GetSecretParameter API directly from your application. This minimizes the exposure surface in the pod file system and Kubernetes Secrets.

Prerequisites

Before you begin, ensure that you have:

• An ACK managed cluster, ACK dedicated cluster, registered cluster, or ACK Serverless cluster in the same region as your OOS service. See Create an ACK managed cluster, Create an ACK One registered cluster, and Create an ACK Serverless cluster

• An OOS encryption parameter. See Create an encrypted parameter and CreateSecretParameter

• kubectl configured to connect to the cluster. See Get a cluster kubeconfig and connect to the cluster using kubectl

Step 1: Install ack-secret-manager

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, click the name of the target cluster. In the left-side pane, choose Applications > Helm.

3. On the Helm page, click Deploy. In the Chart section, find and select ack-secret-manager, keep the default values for other parameters, and click Next. The confirmation message indicates that the chart installs in the kube-system namespace by default. Click Yes. To use a custom namespace, configure Application Name and Namespace in the Basic information step.

4. In the Parameters step, select the latest chart version, configure the parameters below, and click OK. Enable RRSA authentication (recommended): Set rrsa.enable to true. Enable scheduled synchronization (optional): Configure throttling (required for large clusters): If your cluster has many ExternalSecrets, improper concurrency can trigger throttling on OOS or RAM.

   • command.disablePolling: Set to false to enable automatic parameter rotation.

   • command.pollingInterval: Sync frequency in seconds. In this example, this parameter is set to 120 seconds (every 2 minutes). You can adjust the value as needed.

   • command.maxConcurrentOosSecretPulls: Maximum OOS parameters synced per second. Default: 10.

   

   

   

5. After installation, you are redirected to the ack-secret-manager page. Verify that the following resources are created:

   

Step 2: Authorize ack-secret-manager to access OOS

Create a SecretStore to grant ack-secret-manager access to OOS encryption parameters. Choose the authorization method based on your cluster type:

Step 3: Sync OOS parameters to Kubernetes Secrets

After authorization is configured, create an ExternalSecret to specify which OOS parameters to sync and where to store them in Kubernetes.

1. Create an ExternalSecret. Replace the placeholders and save the file as external.yaml:

   apiVersion: 'alibabacloud.com/v1alpha1'
   kind: ExternalSecret
   metadata:
     name: esdemo
   spec:
     provider: oos               # Sync from OOS (default is kms)
     data:
       - key: {OOS parameter name}           # Name of the OOS encryption parameter
         name: {Kubernetes secret key}        # Key in the resulting Kubernetes Secret
         secretStoreRef:                      # Omit if using the worker RAM role method
           name: {secret store name}          # Name of the SecretStore
           namespace: {secret store namespace}

   Apply the ExternalSecret:

   kubectl apply -f external.yaml

2. Verify that the sync succeeded:

   kubectl get secret esdemo

   If a Kubernetes Secret is created, the OOS encryption parameter has been synced to your cluster.

Advanced configurations

{"name":"tom","friends":[{"name":"lily"},{"name":"mark"}]}

apiVersion: 'alibabacloud.com/v1alpha1'
kind: ExternalSecret
metadata:
  name: es-json-demo
spec:
  provider: oos
  data:
    - key: {OOS parameter name}
      secretStoreRef:
        name: {secret store name}
        namespace: {secret store namespace}
      jmesPath:
        - path: "name"
          objectAlias: "myname"
        - path: "friends[0].name"
          objectAlias: "friendname"

{"/name-invalid":"lily","name-invalid/":[{"name":"mark"}]}

apiVersion: 'alibabacloud.com/v1alpha1'
kind: ExternalSecret
metadata:
  name: extract-secret
spec:
  provider: oos
  dataProcess:
    - extract:
        key: {OOS parameter name}
        secretStoreRef:
          name: {secret store name}
          namespace: {secret store namespace}
      replaceRule:
        - source: "^/.*d$"   # Keys starting with / and ending with d → renamed to "tom"
          target: "tom"
        - source: "^n.*/$"   # Keys starting with n and ending with / → renamed to "mark"
          target: "mark"

name: tom
friends:
  - name: lily
  - name: mark

apiVersion: 'alibabacloud.com/v1alpha1'
kind: ExternalSecret
metadata:
  name: es-yaml-demo
spec:
  provider: oos
  data:
    - key: {OOS parameter name}
      secretStoreRef:
        name: {secret store name}
        namespace: {secret store namespace}
      jmesPath:
        - path: "name"
          objectAlias: "myname"
        - path: "friends[0].name"
          objectAlias: "friendname"

/name-invalid: lily
name-invalid/:
  - name: mark

apiVersion: 'alibabacloud.com/v1alpha1'
kind: ExternalSecret
metadata:
  name: extract-secret
spec:
  provider: oos
  dataProcess:
    - extract:
        key: {OOS parameter name}
        secretStoreRef:
          name: {secret store name}
          namespace: {secret store namespace}
      replaceRule:
        - source: "^/.*d$"   # Keys starting with / and ending with d → renamed to "tom"
          target: "tom"
        - source: "^n.*/$"   # Keys starting with n and ending with / → renamed to "mark"
          target: "mark"

What's next

To protect Kubernetes Secrets synced from OOS and cached in your ACK cluster, enable the Secret encryption feature. See Use KMS to encrypt Kubernetes Secrets.