TKE ExternalSecretOperator 实践指南

{
  "version": "2.0",
  "statement": [
    {
      "effect": "allow",
      "action": [
        "ssm:GetSecretValue",
        "ssm:DescribeSecret",
        "ssm:ListSecrets"
      ],
      "resource": [
        "qcs::ssm:ap-guangzhou:uin/100000000001:secret/creatorUin/200000000002/dev-*"
      ]
    }
  ]
}

{
  "effect": "allow",
  "action": [
    "ssm:CreateSecret",
    "ssm:UpdateSecret",
    "ssm:DisableSecret",
    "ssm:DeleteSecret"
  ],
  "resource": [
    "qcs::ssm:ap-guangzhou:uin/100000000001:secret/creatorUin/200000000002/dev-*"
  ]
}

{
  "effect": "allow",
  "action": ["tag:ModifyResourceTags", "tag:DescribeResourceTags"],
  "resource": ["qcs::ssm:ap-guangzhou:uin/100000000001:secret/creatorUin/200000000002/dev-*"]
}

{
  "version": "2.0",
  "statement": [
    {
      "effect": "allow",
      "action": [
        "cam:CreatePolicy",
        "cam:GetPolicy",
        "cam:UpdatePolicy",
        "cam:DeletePolicy",
        "cam:ListPolicies"
      ],
      "resource": ["*"]
    }
  ]
}

{
  "version": "2.0",
  "statement": [
    {
      "effect": "allow",
      "action": [
        "tcr:CreateInstanceToken"
      ],
      "resource": [
        "qcs::tcr:ap-guangzhou:uin/100000000001:instance/tcr-xxxxxxxx"
      ]
    }
  ]
}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-sa
  namespace: my-ns
  annotations:
    tke.cloud.tencent.com/role-arn: qcs::cam::uin/100000000001:roleName/eso-runtime-role  # 步骤 3 拿到的 RoleArn ($my_pod_role_arn)
    tke.cloud.tencent.com/audience: sts.cloud.tencent.com                                  # 与步骤 3 oidc:aud 严格相等 ($my_pod_audience)
    tke.cloud.tencent.com/providerID: cls-xxxxxxxx                                         # 步骤 1/2 的身份提供商名 ($my_provider_id)

# tencent-credentials.yaml
apiVersion: v1
kind: Secret
metadata:
  name: tencent-credentials
  namespace: default
type: Opaque
stringData:
  secret-id: "AKIDxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  secret-key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

kubectl apply -f tencent-credentials.yaml

apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: tencent-ssm-store
  namespace: default
spec:
  provider:
    tencent:
      regionID: ap-guangzhou
      auth:
        secretRef:
          accessKeyIDSecretRef:
            name: tencent-credentials
            key: secret-id
          accessKeySecretSecretRef:
            name: tencent-credentials
            key: secret-key

apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: tencent-ssm-store-assumed
  namespace: default
spec:
  provider:
    tencent:
      regionID: ap-guangzhou
      role: qcs::cam::uin/100000000001:roleName/eso-runtime-role  # 见 §3.2.2
      auth:
        secretRef:
          accessKeyIDSecretRef:
            name: tencent-credentials
            key: secret-id
          accessKeySecretSecretRef:
            name: tencent-credentials
            key: secret-key

kubectl get secretstore tencent-ssm-store -o jsonpath='{.status.conditions}'
# 期望看到 type=Ready, status=True

apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: tencent-ssm-store-oidc
  namespace: my-ns
spec:
  provider:
    tencent:
      regionID: ap-guangzhou
      auth:
        serviceAccountRef:
          name: my-sa            # 见 §3.2.3 中带三条 annotation 的 SA（providerID / role-arn / audience）

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: oidc-pull-app
  namespace: my-ns
spec:
  refreshInterval: 1m
  secretStoreRef:
    kind: SecretStore
    name: tencent-ssm-store-oidc       # §5.2 创建的 OIDC SecretStore
  target:
    name: oidc-pull-app
    creationPolicy: Owner
  data:
  - secretKey: username
    remoteRef:
      key: dev-app-oidc-sample        # 远端凭据名（由运维侧用 tccli 创建）
      version: v1                     # 必填原因详见 §6 通用提示
      property: username              # 可选：JSON property
  - secretKey: password
    remoteRef:
      key: dev-app-oidc-sample
      version: v1
      property: password

apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: tencent-ssm-cluster-store
spec:
  provider:
    tencent:
      regionID: ap-guangzhou
      auth:
        secretRef:
          accessKeyIDSecretRef:
            name: tencent-credentials
            namespace: default          # ClusterSecretStore 必须显式 namespace
            key: secret-id
          accessKeySecretSecretRef:
            name: tencent-credentials
            namespace: default
            key: secret-key

kubectl get clustersecretstore tencent-ssm-cluster-store -o jsonpath='{.status.conditions}'
# 期望看到 type=Ready, status=True

spec:
  secretStoreRef:
    name: tencent-ssm-cluster-store
    kind: ClusterSecretStore

apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: tencent-ssm-store
spec:
  provider:
    tencent:
      regionID: ap-guangzhou
      prefix: "dev/"                # 所有 Secret 名自动加 "dev/" 前缀，做隔离
      auth:
        secretRef:
          accessKeyIDSecretRef: { name: tencent-credentials, key: secret-id }
          accessKeySecretSecretRef: { name: tencent-credentials, key: secret-key }
      ssm:
        recoveryWindowInDays: 7      # 删除后保留 7 天可恢复，0 立即销毁
        networkFailureMaxRetries: 3
        rateLimitExceededMaxRetries: 5

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: app-db-es
  namespace: default
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: tencent-ssm-store
    kind: SecretStore
  target:
    name: app-db                  # 产出的 K8s Secret 名
    creationPolicy: Owner
  data:
    - secretKey: DB_USER          # K8s Secret 中的键
      remoteRef:
        key: dev-app-db           # SSM 中的 SecretName
        property: username        # JSON 路径；非 JSON 凭据省略
    - secretKey: DB_PASS
      remoteRef:
        key: dev-app-db
        property: password

kubectl apply -f app-db-es.yaml

# 1) ExternalSecret 状态：必须 Ready=True，SecretSynced=True
kubectl get externalsecret app-db-es -o jsonpath='{.status.conditions}'
# 期望片段：type=Ready, status=True；以及 reason=SecretSynced

# 2) 目标 Secret 已经被创建，键齐全
kubectl get secret app-db -o jsonpath='{.data}' | jq 'keys'
# 期望：["DB_PASS","DB_USER"]

# 3) 解码后值与 SSM 完全一致
kubectl get secret app-db -o jsonpath='{.data.DB_USER}' | base64 -d ; echo
kubectl get secret app-db -o jsonpath='{.data.DB_PASS}' | base64 -d ; echo

kubectl delete externalsecret app-db-es
kubectl get secret app-db                  # creationPolicy=Owner+默认 Retain：仍在；如需一并删 Secret，加 deletionPolicy=Delete（见 6.10）

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: app-db-all-es
  namespace: default
spec:
  refreshInterval: 1h
  secretStoreRef: { name: tencent-ssm-store, kind: SecretStore }
  target: { name: app-db-all }
  dataFrom:
    - extract:
        key: dev-app-db