6 Accessing Cloud Secret Stores

Chapter 5 introduced HashiCorp Vault to securely store and manage sensitive assets for applications deployed to Kubernetes and demonstrate how both applications and Vault can be configured to provide seamless integration with one another.

This chapter expands the idea introduced in the previous chapter of using an external secrets management tool to store secrets and injecting them inside the Pod either as a volume or as an environment variable. But in this chapter we’ll focus on cloud secret stores like Google Secret Manager, Azure Key Vault, or AWS Secrets Manager.

First, we’ll learn about Container Storage Interface (CSI) and Secret Store CSI driver and using them to inject secrets stored in HashiCorp Vault. Then we’ll see how to inject secrets using secret store CSI driver as Kubernetes secrets and the usage of secret auto rotation. Finally, the integration between CSI driver and Google Secret Manager, Azure Key Vault, and AWS Secrets Manager is shown so secrets are injected directly from the secret store to the Pod.

6.1 Container Storage Interface & Secret Store CSI drivers

6.1.1 Container Storage Interface (CSI)

6.1.2 Container Storage Interface and Kubernetes

6.1.3 Container Storage Interface and Secrets

6.1.4 Installing pre-requisites

6.1.5 Install the Secrets Store CSI Driver

6.1.6 HashiCorp Vault Secrets through Secret Store CSI Volume

6.2 Synchronize CSI secrets as Kubernetes Secrets

6.2.1 Preparing the namespace

6.2.2 Define a SecretProviderClass resource with secretObjects

6.3 Autorotation of secrets to increase security posture

6.3.1 Preparing the namespace

6.3.2 Deploy the Pod with secret mounted

6.3.3 Updating the secret

6.4 Consuming secrets from cloud secret stores