Use a secret in a pod-Container Compute Service(ACS)-阿里云帮助中心

In many business scenarios, such as connecting workloads to backend databases or validating client requests, you must store sensitive information like usernames, passwords, and certificates. To prevent data leaks, we recommend using secrets in your Alibaba Cloud Container Compute Service (ACS) cluster to manage this information. This topic shows you how to create a secret in the Container Compute Service console and then use it by mounting it as a volume or exposing it as an environment variable.

Prerequisites

The pod and the secret must be in the same cluster and namespace.
You have connected to a Kubernetes cluster using kubectl.

Create a secret

This example creates a secret named secret-test.

Log on to the ACS console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of the target cluster. In the left navigation pane, choose Workloads > Deployments.
On the Deployments page, click Create from YAML.

Select a sample template or customize the YAML content, and then click Create.

The following YAML template creates a secret.

apiVersion: v1
kind: Secret
metadata:
  name: secret-test
type: Opaque
data:
  username: YWRtaW4=  # The plaintext is admin. Encode it in Base64.
  password: MTIzNDU=  # The plaintext is 12345. Encode it in Base64.

To create a secret by using the console's UI forms instead of YAML, see Create a secret.

Use a secret as a volume

Kubectl

You can mount a secret as files inside a pod. In this example, the username and password keys from the secret-test secret are mounted as files in the /srt directory.

Create a file named example0.yaml and copy the following content into it.

apiVersion: v1
kind: Pod
metadata:
  name: pod0
spec:
  containers:
  - name: redis
    image: redis
    volumeMounts:
    - name: srt
      mountPath: "/srt"
      readOnly: true
  volumes:
  - name: srt
    secret:
      secretName: secret-test

Create the pod.
```
kubectl apply -f example0.yaml
```

Verify that the secret is mounted.

kubectl describe pod pod0 | grep -A 4 Volumes

Expected output:

Volumes:
  srt:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  secret-test
    Optional:    false

Console

Log on to the ACS console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of the target cluster. In the left navigation pane, choose Workloads > Deployments.
On the Deployments page, click Create from Image.

Note
For detailed parameter descriptions, see Create a stateless workload (deployment).
On the Basic Information tab, configure the parameters as needed and click Next.
On the Container tab, in the Volume section, click Add Local Storage. Set PV type to secret. For mount source, select the secret that you created. For container path, enter the access path in the container. After you configure the information, click Next.

The following is an example configuration.

For mount source, select secret-test. For container path, enter /srt.
On the Advanced tab, configure the parameters and click Create.

Use a secret as environment variables

You can use one of the following methods.

Kubectl

This example exposes the username and password keys from the secret-test secret as environment variables in the pod.

Create a file named example1.yaml and copy the following content into it.

apiVersion: v1
kind: Pod
metadata:
  name: pod1
spec:
  containers:
  - name: redis
    image: redis
    env:
      - name: USERNAME
        valueFrom:
          secretKeyRef:
            name: secret-test
            key: username
      - name: PASSWORD
        valueFrom:
          secretKeyRef:
            name: secret-test
            key: password

Create the pod.
```
kubectl apply -f example1.yaml
```

Verify that the environment variables are set.

kubectl describe pod pod1 | grep -A 2 Environment

Expected output:

    Environment:
      USERNAME:                 <set to the key 'username' in secret 'secret-test'>  Optional: false
      PASSWORD:                 <set to the key 'password' in secret 'secret-test'>  Optional: false

Console

Log on to the ACS console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of the target cluster. In the left navigation pane, choose Workloads > Deployments.
On the Deployments page, click Create from Image.

Note
For more information, see Create a stateless workload (deployment).
On the Basic Information tab, configure the parameters as needed and click Next.
On the Container tab, in the Environments section, click Add. Set type to Secret. For value/value from, select the secret that you created. Then, select the key that you want to reference and enter a name for the variable.