Penyimpanan informasi sensitif di Kubernetes menggunakan Cloud Code untuk Cloud Shell
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini memberikan pengantar singkat tentang apa yang dimaksud dengan secret Kubernetes, dan cara Cloud Code membantu mengaktifkan Secret Manager API untuk membuat, menggunakan, dan menyimpannya.
Pengantar secret Kubernetes
Saat membuat aplikasi Kubernetes, Anda sering kali perlu meneruskan data sensitif dalam jumlah
kecil untuk sandi, kunci SSH, atau token OAuth. Daripada
menyimpan informasi ini dalam spesifikasi pod atau image container, secret
Kubernetes dapat dibuat untuk menyimpan data sensitif.
Secara default, secret Kubernetes disimpan tanpa dienkripsi di penyimpanan data dasar
server API. Siapa saja yang memiliki akses API dapat mengambil atau mengubah secret.
Dokumentasi Secret Kubernetes
menyarankan untuk melakukan minimal langkah-langkah berikut guna menggunakan secret Kubernetes dengan aman:
Cloud Code membantu Anda menggunakan Secret Manager API untuk membuat, membuat versi, dan menyimpan secret dengan enkripsi dalam penyimpanan dari dalam IDE.
Anda dapat menggunakan Secret Manager secara eksklusif di Cloud Code, atau
selain alat lain yang sudah Anda gunakan untuk pengelolaan secret.
Tindakan yang tersedia dalam IDE Anda dengan Cloud Code meliputi:
Untuk mengetahui petunjuk langkah demi langkah tentang cara membuat, membuat versi, menggunakan, dan menghapus secret di Cloud Code, lihat Mengelola secret.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[[["\u003cp\u003eKubernetes secrets are used to store sensitive data like passwords and tokens, rather than storing them directly in pod specifications or container images.\u003c/p\u003e\n"],["\u003cp\u003eBy default, Kubernetes secrets are stored unencrypted, so it is highly recommended to enable encryption at rest, configure RBAC rules, restrict access to specific containers, and consider external secret store providers for security.\u003c/p\u003e\n"],["\u003cp\u003eCloud Code helps users to create, manage, and store secrets using the Secret Manager API directly from their IDE, offering encryption at rest.\u003c/p\u003e\n"],["\u003cp\u003eWith Cloud Code, users can perform various actions such as enabling the Secret Manager API, creating new secrets, managing versions, and integrating secrets as environment variables or mounted volumes.\u003c/p\u003e\n"],["\u003cp\u003eCloud Code offers a comprehensive guide, allowing users to use step-by-step instructions to create, version, use and delete secrets, all while maintaining security.\u003c/p\u003e\n"]]],[],null,["# Sensitive information storage in Kubernetes using Cloud Code for Cloud Shell\n\nThis page provides a quick introduction to what Kubernetes secrets are, and how\nCloud Code helps enable the Secret Manager API to\ncreate, use, and store them.\n\nIntroduction to Kubernetes secrets\n----------------------------------\n\nWhen creating Kubernetes applications, it's often necessary to pass small\namounts of sensitive data for passwords, SSH keys, or OAuth tokens. Rather than\nstore this information in a pod specification or container image, Kubernetes\nsecrets can be created to store the sensitive data.\n\nBy default, Kubernetes secrets are stored unencrypted in the API server's\nunderlying data store. Anyone with API access can retrieve or modify a secret.\nThe [Kubernetes Secrets documentation](https://kubernetes.io/docs/concepts/configuration/secret/)\nrecommends taking at least the following steps in order to safely use\nKubernetes secrets:\n\n- [Enable Encryption at Rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) for Secrets.\n- [Enable or configure RBAC rules](https://kubernetes.io/docs/reference/access-authn-authz/authorization/) with least-privilege access to Secrets.\n- Restrict Secret access to specific containers.\n- [Consider using external Secret store providers](https://secrets-store-csi-driver.sigs.k8s.io/concepts.html#provider-for-the-secrets-store-csi-driver).\n\nSecret Manager in Cloud Code\n----------------------------\n\nCloud Code helps you use the Secret Manager API to\ncreate, version, and store your secrets with\n[encryption at rest](/secret-manager/docs/encryption)\nfrom within your IDE.\nYou can use Secret Manager exclusively in Cloud Code, or\nin addition to other tools you already use for secret management.\n\nActions available within your IDE with Cloud Code include:\n\n- [Enable the Secret Manager API](/code/docs/shell/secret-manager#enabling).\n- [Create Kubernetes secrets](/code/docs/shell/secret-manager#creating_secrets) using the Secret Manager view or the editor view.\n- [Version](/code/docs/shell/secret-manager#creating_new_versions_of_secrets), view, and delete secrets.\n- [Access secrets from your application](/code/docs/shell/secret-manager#accessing_secrets_from_your_application).\n- [Add secrets as environment variables](/code/docs/shell/secret-manager#adding_a_secret_as_an_environment_variable).\n- [Mount a secret as a volume](/code/docs/shell/secret-manager#mounting_a_secret_as_a_volume).\n\nWork with Kubernetes secrets in Cloud Code\n------------------------------------------\n\nFor step-by-step instructions on creating, versioning, using, and deleting\nsecrets in Cloud Code, see [Manage secrets](/code/docs/shell/secret-manager).\n\nWhat's next\n-----------\n\n- Read more about Kubernetes secrets in the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/secret/).\n- Familiarize yourself with [good practices for Kubernetes secrets](https://kubernetes.io/docs/concepts/security/secrets-good-practices/).\n- Consider using a [service account token](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#service-account-tokens) or other [alternatives](https://kubernetes.io/docs/concepts/configuration/secret/#alternatives-to-secrets) to secrets."]]
