Import Alibaba Cloud KMS secrets for applications - Container Service for Kubernetes

Import Key Management Service (KMS) secrets into pods as files, Kubernetes Secrets, or through HTTP.

Add-on overview overview

ack-secret-manager: Syncs secrets from KMS Secrets Manager to Kubernetes Secrets in the cluster so that applications can securely access sensitive data. Workloads can mount these Secrets as a file system.
csi-secrets-store-provider-alibabacloud: Syncs secrets from KMS Secrets Manager to Kubernetes Secrets. Also supports mounting secrets directly into applications as a file system through CSI inline volumes, ideal for file-based access.
ack-kms-agent-webhook-injector: Injects the KMS Agent as a sidecar into pods. Applications fetch KMS secrets through the agent over local HTTP and cache them in memory, avoiding hardcoded sensitive data.

Component	Applicable clusters	Description	Actions
ack-secret-manager	ACK managed clusters ACK dedicated clusters Registered clusters ACK Serverless clusters	Supports Secret sync and updates.	Import secrets by using ack-secret-manager
csi-secrets-store-provider-alibabacloud	Clusters of Kubernetes 1.20 or later: ACK managed clusters ACK dedicated clusters Registered clusters	Supports Secret sync and updates. Supports mounting secrets directly into applications as a file system via CSI inline volumes.	Import secrets by using csi-secrets-store-provider-alibabacloud
ack-kms-agent-webhook-injector	Clusters of Kubernetes 1.22 or later: ACK managed clusters ACK dedicated clusters	Supports Secret sync and updates. Supports fetching KMS secrets through the KMS Agent's local HTTP interface and caching them in memory.	Import secrets by using ack-kms-agent-webhook-injector

ack-secret-manager and csi-secrets-store-provider-alibabacloud are free but consume worker node resources after installation. Configure the resource requests for each add-on during installation.
Using KMS Secrets Manager incurs charges. See Product billing.