Kubernetes Secrets Management by Alex Soto Bueno;Andrew Block; & Andrew Block

Author:Alex Soto Bueno;Andrew Block; & Andrew Block [Bueno, Alex Soto & Block, Andrew]
Language: eng
Format: epub
Publisher: Simon & Schuster
Published: 2022-12-19T23:00:00+00:00

5.3 The Vault Agent Injector

The Kubernetes Auth Method simplified how applications deployed on Kubernetes can access values stored within Vault. One of the challenges presented by using either the token or Kubernetes auth methods, as described in section 5.2.1, is that the application needs to be Vault aware. In many cases, especially in legacy applications or those provided by third-party vendors, it may not be possible to modify the source code to configure this type of integration.

To overcome these challenges, several approaches emerged, using patterns in the Kubernetes ecosystem to address how values stored within Vault are made available to applications. Each leaned on a key characteristic of a Pod in Kubernetes, through which volumes could be shared between containers using an emptyDir volume type. A separate container could then be packaged within the Pod with the responsibility of facilitating the interaction with Vault and providing the secret values to the application through the shared volume.

Two patterns in Kubernetes were adopted to support this approach:

init container—A container, or set of containers, that executes before the application containers are started. In the context of Vault, assets are retrieved from Vault and placed in a shared volume that is pre-populated for the application to consume.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.