ACK integration with KMS secrets - Key Management Service

After you install the ack-secret-manager Kubernetes plug-in, you can configure it to periodically fetch the latest secret values from Key Management Service (KMS) and cache them in your Container Service for Kubernetes (ACK) cluster. This lets you use dynamic secrets from KMS like native Kubernetes secrets, preventing sensitive data exposure during the application development and build processes.

Procedure

Install the ack-secret-manager plug-in.

For Container Service for Kubernetes (ACK) clusters

Log on to the ACK console and find ack-secret-manager in the Marketplace.
On the ack-secret-manager page, click Quick Deployment in the upper-right corner.
In the panel, you can keep the default values for Cluster, Namespace, and Release Name. Then, click Next.

On the Parameters page, configure the parameters and click OK.

Parameter

Description

Example

command.backend

The backend for the external secret management system. Currently, only Alibaba Cloud KMS is supported. Set this parameter to alicloud-kms.

alicloud-kms

command.region

The region from which to retrieve secrets.

cn-hangzhou

command.disablePolling

Specifies whether to disable automatic synchronization of the latest secret values from the KMS backend. Set this to true to disable synchronization. Default value: false.

false

command.pollingInterval

The synchronization interval for secrets from the KMS backend.

120s

After the deployment succeeds, you are redirected to the ack-secret-manager page for the cluster. On the Resources page, verify that the following six Kubernetes resources have been created: ack-secret-manager (ServiceAccount), externalsecrets.alibabacloud.com (CustomResourceDefinition), ack-secret-manager (ClusterRole), ack-secret-manager (ClusterRoleBinding), ack-secret-manager-auth (ClusterRoleBinding), and ack-secret-manager (Deployment).

For self-managed Kubernetes clusters, visit ack-secret-manager to install the plug-in.

Create a secret in KMS.

All secret types are supported. For more information, see Manage and use generic secrets, Manage and use RAM secrets, Manage and use ApsaraDB RDS secrets, or Manage and use ECS secrets.

Grant the ack-secret-manager plug-in access to KMS.

Access using Shared KMS

This method is suitable for secrets in a KMS instance and secrets that are not in a KMS instance, including those created in earlier KMS versions that did not require an instance.

In Resource Access Management (RAM), create a custom policy to grant access to KMS secrets. The following code provides an example policy. You can customize the policy based on your business requirements. For more information, see Custom policies for Key Management Service.
```
{
    "Action": [
       "kms:GetSecretValue",
       "kms:Decrypt"
    ],
    "Resource": [
        "*"
    ],
    "Effect": "Allow"
}
```

Grant permissions to the Container Service workload or Pod.

Method	Description
Add permissions to the cluster's worker role	Log on to the ACK console. In the left-side navigation pane, choose Clusters. Find the target cluster and click Details in the Actions column. On the Cluster Resources tab, click the worker role named KubernetesWorkerRole-******. This redirects you to the RAM console, where you can attach your custom policy.
Use RAM Roles for Service Accounts (RRSA) for Pod-level authorization	Enable the RRSA feature. Use the RRSA feature. Create a RAM role for the specified service account, configure a trust policy for the RAM role, and then attach your custom policy.

Access using a KMS instance endpoint ({kmsInstanceId}.cryptoservice.kms.aliyuncs.com)

This method applies only to secrets in KMS instances. We recommend this approach if you want to restrict network access to KMS within your Virtual Private Cloud (VPC). For more information, see Create an application access point.

Note

Before you use a KMS instance endpoint, bind the workload's or Pod's VPC to the KMS instance. For more information, see Access a KMS instance from multiple VPCs in the same region.

In the ack-secret-manager plug-in, configure parameters such as protocol (the protocol for accessing KMS), endpoint (the access point), client key (the authentication method), and SecretName (the secret name). For details, see the ack-secret-manager documentation.

Next steps

To further protect secrets fetched from KMS and cached in your cluster, enable at-rest encryption for Kubernetes secrets. For more information, see Use KMS to encrypt Kubernetes secrets at rest.

Note

This encryption feature also protects other static secrets in the Kubernetes cluster, such as system secrets.

Key Management Service:Integrate KMS secrets with ACK

Procedure

Next steps

Related documents