Secret Manager integrations

Available in VPC

In Ncloud Kubernetes Service, you can integrate and use secrets stored in Secret Manager. This feature is provided through Secrets Store CSI Driver from Kubernetes and secrets-store-csi-driver-provider-ncp from Ncloud Kubernetes Service.

Limitations

Secret Manager is only available in the Korea and Japan regions.

Requirements

You must subscribe to Secret Manager.
If you use a Sub Account, the NCP_SECRETMANAGER_USER permission is required to view Secret Manager.

Features

You can mount secrets stored in Secret Manager to pods as volumes.
When a secret stored in Secret Manager is rotated, the secret mounted to the pod can also be rotated automatically.
You can sync secrets stored in Secret Manager with Kubernetes Secrets.

Installation

To integrate with Secret Manager, you must install secrets-store-csi-driver and secrets-store-csi-driver-provider-ncp.

Install secrets-store-csi-driver using the following command.
- To use the secret rotation feature, add the --set enableSecretRotation=true setting.
- To use the Kubernetes Secret sync feature, add the --set syncSecret.enabled=true setting.
```
$ helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
$ helm install csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver --namespace kube-system
```
Create the credentials for calling the Secret Manager API.
- ncloud_access_key_id: Ncloud AcessKey
- ncloud_secret_access_key: Ncloud SecretKey
- secretmanager_api_url
  - Korea: https://ocapi-kr.ncloud.com/secretmanager/api/v1
  - Japan: https://ocapi-jp.ncloud.com/secretmanager/api/v1
```
$ vi configure
ncloud_access_key_id=<ACCESS_KEY_ID>
ncloud_secret_access_key=<SECRET_ACESS_KEY>
secretmanager_api_url=<SecretManager API URL>
```

Create the credentials as a Kubernetes Secret using the following command.

$ kubectl -n kube-system create secret generic ncp-secrets-store-credentials --from-file=./configure

Install secrets-store-csi-driver-provider-ncp for your region using the following command.

# Korea Region
$ kubectl --kubeconfig=$KUBE_CONFIG apply -f https://kr.object.ncloudstorage.com/nks-download/secrets-store-csi-driver-provider-ncp/pub/kr/v0.1.0/provider-ncp.yaml

# Japan Region
$ kubectl --kubeconfig=$KUBE_CONFIG apply -f https://kr.object.ncloudstorage.com/nks-download/secrets-store-csi-driver-provider-ncp/pub/jp/v0.1.0/provider-ncp.yaml

Check that the installed pods are running properly using the following command.

$ kubectl -n kube-system get po -l app.kubernetes.io/instance=csi-secrets-store
$ kubectl -n kube-system get po -l app=secrets-store-csi-driver-provider-ncp

Usage

Define SecretProviderClass

You can use secrets integrated with Secret Manager by defining a SecretProviderClass.

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-secret
  namespace: my-namespace
spec:
  provider: ncp
  parameters:
    objects: |
      - objectName: "my-secret"
        objectType: "secretmanager"
        path: "my-secret.txt"
      - objectName: "my-secret"
        objectType: "secretmanager"
        secretKey: "id"
        path: "id.txt"
      - objectName: "my-secret"
        objectType: "secretmanager"
        secretKey: "password"
        path: "password.txt"
  secretObjects:
  - secretName: my-secret
    type: Opaque
    data:
    - objectName: my-secret.txt
      key: my-key

provider: ncp
objects: Defines the secrets to mount as files.
- objectName: Name of the secret created in SecretManager.
- objectType: secretmanager
- path: Name of the file to be mounted to the pod.
- secretKey (optional): Uses only the value of the specified key from the secret stored in SecretManager. If not defined, all key-value pairs stored in the secret are used in JSON format.
secretObjects (optional): Set this to sync with a Kubernetes Secret.
- secretName: Name of the Kubernetes Secret to be created.
- data.objectName: Name of the file mounted to the pod (path).
- data.key: Key name in the data of the created Secret.

Configure pod mounts

You can use it by setting secretProviderClass in the pod's volumes.

  volumes:
  - name: my-secret
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "my-secret"

Check secret mount status

You can check the status of the secrets currently mounted to a pod by querying SecretProviderClassPodStatus.

$ kubectl get secretproviderclasspodstatuses <pod_name>-<namespace>-<secretproviderclass_name> -o yaml
...
status:
  mounted: true
  objects:
  - id: secretmanager/my-secret
    version: "1"
  podName: my-pod
  secretProviderClassName: my-secret
  targetPath: /var/lib/kubelet/pods/1d401b1a-9a16-4335-b015-59e11e87b349/volumes/kubernetes.io~csi/my-secret/mount

Use secret rotation

To rotate secrets, see Secret rotation settings in Secret Manager. When a secret in Secret Manager is rotated, the file where the secret is mounted is also synced automatically. This feature is provided as an alpha feature of secrets-store-csi-driver. Before using it, see the official guide.