Secret Management

Secret

Secret is a K8S API resource used to store sensitive information like passwords, OAuth tokens, and SSH keys. Users can manage secret resources in CCE via the console or kubectl.

Prerequisites

• A K8S Cluster CCE has been created. For specific operations, refer to Create a K8S Cluster CCE.
• A namespace has been created. For specific operations, refer to Basic Operations of Namespaces.

Manage secret via the console

Create secret

1. Sign in to the Baidu AI Cloud management console. Navigate to Product Services - Cloud Native - Cloud Container Engine (CCE). Click Cluster Management - Cluster List, then select the target cluster to enter the Cluster Details page. In the sidebar, click Configuration Management - Secret.

2. On the secret list page, click Create Secret, and the system will pop up a secret pop-up box where you can configure the relevant parameters.

   

3. Click the OK button to complete the creation.

Query secret

Click the target secret name in the list page to open the secret details page in the right sidebar, which includes:

• Basic information: name, namespace, type, creation time, and data information
• Data Information: There is a "Hide" button available, which allows you to toggle the visibility of the data information details.

Edit secret

On the secret list page, select the secret to be edited, click the Edit button, make modifications, and then click the OK button to complete the editing.

Delete secret

On the secret list page, select the secret to be deleted, click the Delete button, and then click OK in the pop-up box to complete the deletion.

Manage secret via kubectl

Secret YAML example:

1apiVersion: v1
2kind: Secret
3metadata:
4  name: baidu-secret
5data:
6  username: dXNlcm5hbWU=  # echo -n "username" | base64
7  password: cGFzc3dvcmQ=  # echo -n "password" | base64

Use secret as a file in Pod:

1apiVersion: apps/v1
2kind: Deployment
3metadata:
4  name: app-nginx
5  labels:
6    app: nginx
7spec:
8  selector:
9    matchLabels:
10      app: nginx
11  template:
12    metadata:
13      labels:
14        app: nginx
15    spec:
16      containers:
17        - name: nginx
18          image: hub.baidubce.com/cce/nginx-alpine-go:latest
19          volumeMounts:
20            - name: foo
21              mountPath: "/etc/foo"
22              readOnly: true
23      volumes:
24        - name: foo
25          secret:
26            secretName: baidu-secret

The file corresponding to the secret baidu-secret will be located in /etc/foo of Pod:

1# Enter container using exec -it
2# ls /etc/foo/
3password  username