Creating a Secret

Prerequisites

• You have created a CCE cluster that requires a secret.

  For details about how to create a CCE cluster, see Creating a CCE Cluster.

• You have created a namespace for the secret. For details, see Creating a Namespace.

Creating a Secret

1. Log in to ServiceStage and choose Application Management > Application Configuration > Secret
2. Click Create.
3. Create a secret by Visualization or YAML.
   • Method 1: Visualization. On the displayed page, set the parameters listed in the following table. Parameters marked with an asterisk (*) are mandatory.

     Table 1 Parameters for creating a secret

     Parameter	Description
     *Name	Name of a secret, which must be unique in the same namespace.
     *Cluster	Cluster where the secret will be used. Click Create Cluster to create a cluster.
     *Namespace	Namespace to which the secret belongs. The default value is default.
     Description	Description of the secret. Click Create Namespace to create a namespace.
     *Secret Type	Select the type of the secret to be created based on service requirements. Opaque: general secret type. If the secret type is not explicitly set in the secret configuration file, the default secret type is Opaque. kubernetes.io/dockerconfigjson: a secret that stores the authentication information required for pulling images from a private repository. IngressTLS: a secret that stores the certificate required by ingresses (layer-7 load balancing services). Other: Enter a secret type that is none of the above.
     *Repository Address	This parameter is valid only when Secret Type is set to kubernetes.io/dockerconfigjson. Enter the address of the image repository.
     *Secret Data	Value of the data field in the application secret file. If the secret type is Opaque, enter the key and value. The value must be encoded using Base64. For more information, see Base64 Encoding. Click Add Data to add secret data. If the secret type is kubernetes.io/dockerconfigjson, enter the image repository address, username, and password. If the secret type is IngressTLS, upload the certificate file and private key file. If the secret type is Other, enter the secret type, key, and value.
     Secret Label	Labels are attached to objects, such as applications, nodes, and services, in the form of key-value pairs. Labels define the identifiable attributes of these objects and are used to manage and select the objects. Click Add Label. Set keys and values.

   • Method 2: YAML.
     

     To create a secret by uploading a file, ensure that the resource description file has been created. ServiceStage supports resource description files in YAML format. For more information, see Secret Resource File Configuration.

     1. Select a cluster from the Cluster drop-down list.
     2. (Optional) Click Upload File, select the created secret file, and click Open.
     3. Write or modify the secret file in Orchestration content.

4. Click Create.

   The new secret is displayed in the secret list.

Secret Resource File Configuration

This section provides examples of configuring secret resource description files.

For example, you can retrieve the username and password for an application through a secret.

username: my-username

password: my-password

The content in the secret file secret.yaml is as follows. The value must be encoded using Base64. For more information, see Base64 Encoding.

apiVersion: v1
kind: Secret
metadata:
  name: mysecret           #Secret name.
  namespace: default       #Namespace. The default value is default.
data:
  username: ******    #The value must be encoded using Base64.
  password: ******  #The value must be encoded using Base64.
type: Opaque     #You are advised not to change this parameter value.

Base64 Encoding

To encrypt a string using Base64, run the echo -n'Content to be encoded' | base64 command in the local Linux environment. Example:

root@ubuntu:~# echo -n '3306' | base64
MzMwNg==

Where,

• 3306 is the content to be encoded.
• MzMwNg== is the encoded content.

Managing Secrets

The secret list contains system secrets, which can only be viewed and cannot be modified or deleted.