Secrets store sensitive configuration data such as usernames, passwords, and certificates that a workload needs to connect to a backend database or to authenticate client requests. Use secrets in Alibaba Cloud Container Compute Service (ACS) clusters to manage this data without exposing it.
Prerequisites
You have created an ACS cluster.
Secret types
Secrets are available in several types, such as:
-
ServiceAccount: a secret used to access the Kubernetes API. Kubernetes creates ServiceAccount secrets automatically and mounts them to the /run/secrets/kubernetes.io/serviceaccount directory of a pod.
-
Opaque: a Base64-encoded secret that stores sensitive data such as passwords and certificates.
The procedures in this topic use the ACS console, where you can create a secret in one click. ACS automatically encodes plaintext data into Base64 format. To create a secret manually from the command line, see Kubernetes Secret.
Create a secret
-
Log on to the ACS console. In the left navigation pane, click Clusters.
-
On the Clusters page, click the name of the target cluster. In the left navigation pane, choose Configurations > Secrets.
-
On the Secrets page, select the Namespace that the secret belongs to. Then click Create in the upper-right corner.
-
In the panel that appears, configure the parameters described in the following table.
Parameter
Description
Name
Enter a name for the secret.
Type
Valid values: Opaque, Private Repository Logon Secret, and TLS Certificate.
Opaque
If you set the type to Opaque, configure the data of the secret: click Add, and then enter the name and the value of the secret in the Name and Value text boxes. (Optional) To encode the plaintext data into Base64 format, select Encode Data Values Using Base64.
Private Repository Logon Secret
If you set the type to Private Repository Logon Secret, configure the following parameters: Docker Registry URL: enter the address of the image repository that the secret applies to; Username: enter the username of the image repository; Password: enter the password of the image repository.
TLS Certificate
If you set the type to TLS Certificate, configure the following parameters: Certificates: enter the TLS certificate; Key: enter the private key of the TLS certificate.
View the details of a secret
After you create a secret, you can view its basic information and details on the Secrets page.
Click the name of the target secret.
Click the 
icon to view the data in plaintext.
Edit a secret
In the Actions column of the target secret, click Edit to modify its information.
Delete a secret
In the Actions column of the target secret, click Delete.
To keep your cluster stable and secure, do not delete or modify the secrets automatically created in system namespaces such as kube-system.
References
To use a secret in an ACS cluster as a volume or an environment variable, see Use secrets in pods.