2 posts tagged with "secrets-manager"

As workloads grow, you need to adjust node capacity. When passwords or API keys change, you also need to reflect those changes in the applications that use them. It is also important to regularly review the cluster access scope and node status. In particular, manually managing nodes and secrets increases repetitive work and can leave configuration changes applied to only some environments.

Recent Kubernetes Engine updates address these operational challenges through cluster features, node automation, and centralized secret integration. Karpenter and External Secrets Operator (ESO) are open-source projects in the Kubernetes ecosystem. Kubernetes Engine provides a Provider and distribution so that you can use KakaoCloud resources and Secrets Manager. This post distinguishes each project's role from the additional configuration required in KakaoCloud.

Improved cluster operations​

We improved operational features so that you can configure the API server access scope more precisely and check node status and network configuration more easily.

The main changes are as follows:

• API server endpoint access control: You can allow access from anywhere or restrict it to a list of allowed IPv4 CIDRs. You can also change the allowed range in existing clusters.
• Improved Admission Webhook communication: In Kubernetes 1.34 and later, the API server communicates with the Admission Webhook server through Konnectivity, so you do not need to set hostNetwork: true on the Webhook server pod.
• Node status diagnostics and topology: Node Problem Detector is installed by default and managed by Kubernetes Engine in Kubernetes 1.34 and later clusters. The Topology tab on the cluster and node pool detail screens shows the subnet and node configuration.
• Improved load balancer configuration: In Kubernetes 1.30 and later, you can configure load balancers with loadBalancerClass and new annotations.

Automatically manage worker nodes based on workload requirements​

Traffic and workloads do not remain constant. When requests spike or a large job starts, you need more nodes to run pods. When the work ends, you need to reduce unused capacity. Karpenter is a controller that monitors unscheduled pods in a cluster and prepares nodes that meet the pods' resource requirements and placement conditions. In Kubernetes Engine, this behavior is implemented by installing the Karpenter Provider, which connects to the KakaoCloud Virtual Machine API.

Karpenter creates Virtual Machines based on pod resource requirements and node policies, and reclaims nodes that are no longer needed when usage decreases. Because created nodes are managed separately from managed node pools, you can secure the capacity needed for highly variable workloads without directly adjusting the number of nodes in a managed node pool.

Rather than replacing existing managed node pools, Karpenter can be used as a separate node automation layer for highly variable workloads. You can separate GPU workloads into a GPU-specific NodePool. For the required settings, see Configure GPU worker nodes.

Use Secrets Manager secrets in a cluster​

Database passwords and API keys are used by multiple workloads and changed periodically. Instead of copying these values directly to each cluster, manage Secrets Manager as the source of truth so that the open-source External Secrets Operator (ESO) can synchronize the required values to Kubernetes Secrets. Applications can continue to reference Kubernetes Secrets as environment variables or volumes, so you do not need to change your code to call the Secrets Manager API directly.

Kubernetes Engine provides the Secrets Manager Provider in the KakaoCloud ESO distribution. In the integration settings, specify the secret to retrieve, the target Kubernetes Secret, and the refresh interval. ESO then periodically retrieves the value from Secrets Manager and creates or updates the Kubernetes Secret.

To try the integration yourself, complete the following tutorials in order:

• Integrate Kubernetes Engine with Secrets Manager: Install ESO and configure credentials and synchronization resources to verify the basic integration.
• Use ESO secrets in a Kubernetes Engine cluster: Synchronize a string secret and verify that changing the default version in Secrets Manager is reflected in the Kubernetes Secret.

Apply the changes to your environment​

Instead of applying all the features introduced in this post at once, choose them based on the challenges in your operating environment. Review the operations guide for API server access control and cluster operations, and the installation guides and tutorials for Karpenter and ESO. If you are using the existing load balancer annotation, prepare to migrate to the new method before support ends on December 31, 2026.

If you have questions or need support during configuration, contact Helpdesk > Technical support.

Thank you.

👉 Get started with Kubernetes Engine
👉 Start using KakaoCloud

As cloud-based services expand, operational efficiency and scalability have improved significantly, but security requirements have also become more sophisticated. In particular, sensitive information such as authentication information or credentials, which is essential inside systems but can directly lead to security incidents if exposed externally, can no longer be considered safe simply by hiding it. It must be managed systematically, including how it is stored, who accesses it, and how it is renewed and destroyed.

Encryption keys that protect encrypted data must also be managed separately and securely. If even one key is leaked, the meaning of all security can disappear.

To respond to these security needs, KakaoCloud has released two new security services: Secrets Manager and KMS (Key Management Service). In this post, we introduce how these two services can securely separate and manage secrets and keys while improving both security and operational efficiency.

🔐 How to manage secrets securely: Secrets Manager​

When operating a service, there is information that must be protected. Examples include database usernames and passwords, authentication keys for external APIs, and tokens used for communication between services. This information is generally called a secret, and it is a security credential required for applications to communicate safely with external or internal systems. If these secrets are exposed, they can lead to serious security incidents such as unauthorized access or data theft.

KakaoCloud Secrets Manager is a service that securely stores secrets in encrypted form and helps users retrieve them safely only when needed. Traditional methods such as hardcoding secrets in code or setting them as environment variables on operating servers are vulnerable in terms of security and make it difficult to track change history.

With Secrets Manager, however, secrets can be managed centrally in an integrated repository, and a version is automatically created every time a change is made, allowing change history to be tracked systematically. For example, even if an incorrect value is saved by mistake, it can be rolled back easily to a previous version. If needed, only a specific version can be deactivated or destroyed. Currently active secrets remain in the Active state, and availability is clearly distinguished by status.

In addition, integration with IAM allows secret access permissions to be controlled granularly by user or service account. For example,

• Secrets Manager Project Manager can perform all management tasks such as creating, modifying, and deleting secrets.
• Secrets Manager Project Viewer can be configured to only view secret lists, versions, and status.

In this way, permission separation enables safer and more flexible secret operations.

🔑 How to encrypt data and handle keys securely: KMS​

As important as data encryption is how securely the "keys" that decrypt that data are managed. Databases containing customer information, sensitive logs, and files in cloud storage must all be protected through encryption, and the creation and operation of encryption keys for this purpose must be carried out systematically.

KakaoCloud KMS (Key Management Service) is a service that helps users create, securely store, rotate, and destroy encryption keys used to encrypt data or create digital signatures.

Keys created in KMS can be configured to undergo periodic automatic rotation, and can be immediately deactivated or destroyed when a security event occurs. One key is managed in multiple versions, and even when a new version is created, previous versions are retained so that past data can still be decrypted without issue.

KMS supports industry-standard algorithms such as AES and RSA, and keys can be clearly distinguished as available or unavailable based on their Active, Deactivated, or Destroyed status. It also integrates with KakaoCloud IAM so that access to keys can be controlled granularly by user or service account. Depending on the assigned role,

• KMS Project Manager has full management permissions, including key creation, status changes, and policy configuration.
• KMS Project Viewer has permission to view key metadata and status information.

Because permissions can be separated and configured based on roles, operational stability and security control can both be secured. In addition, key creation, usage, and destruction history are automatically recorded through Cloud Trail, making them useful for security audits and compliance response.

✅ Raise your security level​

Secrets Manager and KMS are newly added services in the existing Security category. They provide a security system that centrally manages secrets and encryption keys and implements more precise permission control through integration with IAM.

Protect sensitive information and build a key management system with just a few clicks in the KakaoCloud console. KakaoCloud will continue strengthening features in line with customer security requirements and providing an integrated security operations environment through integration with various services.

For detailed descriptions and API guides for Secrets Manager and KMS, see the technical documentation below. Thank you.

👉 View Secrets Manager documentation 👉 View KMS documentation