Use a Secret to pull an image for an SAE application - Serverless App Engine

Secrets (Kubernetes Secrets) store sensitive runtime information for your application, such as keys or certificates. You can update Secret values after deployment without rebuilding your application image.

To dynamically fetch configuration data from a configuration center, see Use Nacos of MSE or Manage distributed configurations (ACM).

To store non-sensitive runtime environment variables instead, see Manage and use ConfigMaps (Kubernetes ConfigMaps).

Create a Secret

On the SAE Secrets page, select the target region and namespace at the top, and then click Create. Ensure the selected namespace is where your target application resides.
1. Enter a custom Name for the Secret.
2. Select a Type and configure its settings:
  - Opaque: Stores unstructured sensitive data as key-value pairs, such as passwords or API keys.
    - Key-value Pair: Enter the Key and Value. Click Add to define multiple pairs.
      
      Important
      The Value is stored in Base64-encoded format. You can enter the value in one of the following ways:
      
      Enter the raw Value and enable The value is automatically Base64-encoded..
      
      Enter a pre-encoded Base64 Value and disable The value is automatically Base64-encoded. to prevent double encoding.
  - Image Pull Secret for Private Repository: Stores credentials to access a private image repository. This allows SAE to pull private images during application deployment.
    - Image Repository Address: Use the format <domain_name_or_ip>:<service_port>. Ensure that SAE can connect to the repository. For an Alibaba Cloud Container Registry (ACR) Enterprise Edition instance, see Push and pull images by using an Enterprise Edition instance to learn how to configure network access and obtain the repository address.
    - Username and Password.
  - TLS Certificate: Stores a TLS certificate to enable HTTPS for your application.
    - Cert and Key: The public key (Cert) and private key (Key) of the TLS certificate. The content must be Base64-encoded.
In the Create a Secret list, find the Secret you created. You can Edit, Copy, or Delete it as needed.
Important
- If you modify a Secret, you must manually redeploy any application that references it to apply the changes.
- Deleting a Secret disrupts applications that reference it. Before deleting a Secret, remove all references to it from your applications.

Use a Secret to pull images

To pull an image when deploying an application, see Deploy an application by using an image from an ACR instance that belongs to a different account or Deploy an application by using an image from a non-ACR instance.

Use a Secret as an application environment variable

Create an application
On the SAE Application List page, select a destination region and namespace in the top navigation bar, and then click Create Application. On the Application Basic Information page, configure the parameters and click Next: Advanced Settings.
Change a running application
Warning
After you redeploy an application, the application is restarted. To prevent unpredictable errors such as business interruptions, we recommend that you deploy applications during off-peak hours.

On the SAE Application List page, select a destination region and namespace in the top navigation bar. Click the ID of the target Application to open the application details page.In the navigation pane on the left, click Basic Information. In the upper-right corner, click Deploy Application.
Change a stopped application
On the SAE Application List page, select a destination region and namespace in the top navigation bar. Click the ID of the target Application to open the application details page.Click Basic Information, and then click Modify Application Configuration.

In the Environment Variables section, set Type to Reference the Secret. Enter a custom Variable Name for the application. If you reference all keys from the Secret, you do not need to specify a variable name; the key names are used as the variable names by default. Then, select the The name of the Secret and the Key to reference. You can also select to reference all keys from the Secret. Click Add to add multiple environment variables from Secrets.
Wait for the application to deploy. To verify the configuration, log on to the webshell of an application instance and run the env | grep <variable_name> command. Replace <variable_name> with the actual name that you configured. If the variable and its value are returned, the configuration is successful.

Mount a Secret as a file

You can mount a Secret into an application container's file system. The value of each key in the Secret becomes the content of a separate file. You can customize the file path and filename. If a file with the same name already exists at the mount path, the Secret file overwrites it.

Create an application
On the SAE Application List page, select a destination region and namespace in the top navigation bar, and then click Create Application. On the Application Basic Information page, configure the parameters and click Next: Advanced Settings.
Change a running application
Warning
After you redeploy an application, the application is restarted. To prevent unpredictable errors such as business interruptions, we recommend that you deploy applications during off-peak hours.

On the SAE Application List page, select a destination region and namespace in the top navigation bar. Click the ID of the target Application to open the application details page.In the navigation pane on the left, click Basic Information. In the upper-right corner, click Deploy Application.
Change a stopped application
On the SAE Application List page, select a destination region and namespace in the top navigation bar. Click the ID of the target Application to open the application details page.Click Basic Information, and then click Modify Application Configuration.

In the Secret section, click + Add. Select the The name of the Secret and the Key to mount. You can also choose to mount all keys. Then, enter a custom Mount Path. If you mount a single key, enter an absolute path that includes the filename. If you mount all keys, enter an absolute directory path, and SAE automatically uses each key from the Secret as a filename within that directory.
Wait for the application to deploy. To verify the configuration, log on to the webshell of an application instance and view the content of the file at the specified mount path.