6 Accessing cloud secrets stores

Chapter 5 introduced HashiCorp Vault, which can be used for securely storing and managing sensitive assets for applications deployed to Kubernetes and demonstrated how both applications and Vault can be configured to provide seamless integration with one another. This chapter expands the idea introduced in the previous chapter of using an external secrets management tool to store secrets and injecting them inside the Pod, either as a volume or as an environment variable. But in this chapter we’ll focus on cloud secrets stores, like Google Secret Manager, Azure Key Vault, and AWS Secrets Manager.

First you’ll learn about the Container Storage Interface (CSI) and the Secrets Store CSI Driver, using them to inject secrets stored in HashiCorp Vault. Then you’ll learn about injecting Kubernetes Secrets using the Secrets Store CSI Driver as well as secret auto rotation. Finally, we’ll discuss the integration between the CSI driver and Google Secret Manager, Azure Key Vault, and AWS Secrets Manager, so secrets can be injected directly from the secrets store to the Pod.

6.1 The Container Storage Interface and Secrets Store CSI Driver

6.1.1 Container Storage Interface

6.1.2 Container Storage Interface and Kubernetes

6.1.3 CSI and secrets

6.1.4 Installing prerequisites

6.1.5 Installing the Secrets Store CSI Driver

6.1.6 Consuming HashiCorp Vault secrets via the Secrets Store CSI Driver and the HashiCorp Vault provider

6.2 Synchronizing CSI secrets as Kubernetes Secrets

6.2.1 Preparing the namespace

6.2.2 Defining a SecretProviderClass resource with secretObjects

6.3 Autorotating secrets to improve security posture

6.3.1 Preparing the namespace

6.3.2 Deploying the Pod with a secret mounted