How Vault Works with Kubernetes? How Vault Works with Kubernetes? Vault integrates with Kubernetes using the Kubernetes authentication method and the Vault Agent Injector.This enables secure, automated delivery of secrets into pods without hardcoding them or storing them in Kubernetes Secrets. Benefits: Benefits: No need to expose secrets in Kubernetes Secrets or environment variables. Supports dynamic secrets with auto-expiry and rotation. dynamic secrets Secure and auditable, with access governed by Vault policies What is Vault Agent Injector? The Vault Agent Injector is a Kubernetes Mutation Webhook Controller.It intercepts pod creation events and modifies pod specs if Vault annotations are detected.It adds: Kubernetes Mutation Webhook Controller modifies pod specs An init container (vault-agent-init) to authenticate and fetch secrets init container A sidecar container (vault-agent) that refreshes secrets as needed sidecar container A shared memory volume to store the rendered secrets shared memory volume Vault Agent uses Vault Agent Templates to write secrets as files into the shared volume. Vault Agent Templates Application containers consume secrets from the shared volume, without needing Vault SDKs or environment variables. consume secrets from the shared volume Step 1: Create the EKS Cluster Without Any Node Groups Create an EKS cluster without a node group using the eksctl command eksctl create cluster --name=devopstronaut --region=eu-west-1 --without-nodegroup. By default, eksctl creates a node group with m5.large instances, so we used the --without-nodegroup option to skip creating a default node group eksctl create cluster --name=devopstronaut --region=eu-west-1 --without-nodegroup. Step 2: Create a Managed Node Group Add a node group using the following separate eksctl command eksctl create nodegroup --name devopstronaut-node-group --cluster devopstronaut-cluster --region eu-west-1 --nodes 1 --nodes-min 1 --nodes-max 3 --node-type t3.medium eksctl create nodegroup --name devopstronaut-node-group --cluster devopstronaut-cluster --region eu-west-1 --nodes 1 --nodes-min 1 --nodes-max 3 --node-type t3.medium Explanation of the flags: Explanation of the flags: -- cluster: Specifies the name of the existing EKS cluster to which the node group will be added.
-- name: Names the node group for easy identification.
-- region: Specifies the AWS region.
-- nodes: Sets the initial desired number of nodes (in this case, 2).
-- nodes-min and — nodes-max: Define the minimum and maximum number of nodes for auto-scaling.
-- node-type: The EC2 instance type for the nodes (e.g., m5.large) -- cluster: Specifies the name of the existing EKS cluster to which the node group will be added. -- name: Names the node group for easy identification. -- region: Specifies the AWS region. -- nodes: Sets the initial desired number of nodes (in this case, 2). -- nodes-min and — nodes-max: Define the minimum and maximum number of nodes for auto-scaling. -- node-type: The EC2 instance type for the nodes (e.g., m5.large) Step 3: Configure Context for EKS Cluster: Set the Kubernetes context for the EKS cluster using the following command: aws eks --region eu-west-1 update-kubeconfig --name devopstronaut-cluster aws eks --region eu-west-1 update-kubeconfig --name devopstronaut-cluster Use kubectl get ns to view namespaces and kubectl get nodes to check the status of the nodes in the cluster, verifying that the setup is complete kubectl get ns kubectl get nodes Step 4:Install the Vault Helm chart To add the official HashiCorp chart repository to your Helm client, run the this command helm repo add hashicorp https://helm.releases.hashicorp.com helm repo add hashicorp https://helm.releases.hashicorp.com helm repo add hashicorp https://helm.releases.hashicorp.com This command registers the HashiCorp Helm chart repository so you can install Vault and other tools using Helm. After this, make sure to update your Helm repo list with helm repo update command helm repo update command helm repo update command To install HashiCorp Vault on your Kubernetes cluster in development mode (for testing purposes only), use the following command: helm install vault hashicorp/vault --set “server.dev.enabled=true” development mode helm install vault hashicorp/vault --set “server.dev.enabled=true” helm install vault hashicorp/vault --set “server.dev.enabled=true” Execute the kubectl get pods command to display all the pods currently running in your active Kubernetes namespace kubectl get pods kubectl get pods Look for a pod named something like vault-0that’s your Vault pod. vault-0 Run this command kubectl exec -it vault-0 -- /bin/sh to open an interactive shell inside the vault-0 pod kubectl exec -it vault-0 -- /bin/sh kubectl exec -it vault-0 -- /bin/sh vault-0 Enable the KV version 2 secrets engine at the path devopstronaut using this command vault secrets enable -path=devopstronaut kv-v2 devopstronaut vault secrets enable -path=devopstronaut kv-v2 vault secrets enable -path=devopstronaut kv-v2 Store a secret at the path devopstronaut/myapp/config with the following key-value pairs using this command vault kv put devopstronaut/myapp/config username=”mahi” password=”password@123" devopstronaut/myapp/config vault kv put devopstronaut/myapp/config username=”mahi” password=”password@123" vault kv put devopstronaut/myapp/config username=”mahi” password=”password@123" Retrieve the secret stored at the path devopstronaut/myapp/config using the command vault kv get devopstronaut/myapp/config devopstronaut/myapp/config vault kv get devopstronaut/myapp/config vault kv get devopstronaut/myapp/config Step 5: Configure Kubernetes authentication in Vault Enable the Kubernetes authentication method in Vault with this command vault auth enable kubernetes vault auth enable kubernetes vault auth enable kubernetes Use this command vault write auth/kubernetes/config \kubernetes_host=”https://$KUBERNETES_PORT_443_TCP_ADDR:443" to configure the Kubernetes API server endpoint in Vault vault write auth/kubernetes/config \kubernetes_host=”https://$KUBERNETES_PORT_443_TCP_ADDR:443" vault write auth/kubernetes/config \kubernetes_host=”https://$KUBERNETES_PORT_443_TCP_ADDR:443" https://$KUBERNETES_PORT_443_TCP_ADDR:443 This sets the address Vault uses to validate service account tokens during Kubernetes authentication. Create a Vault policy named devopstronaut-app that grants read access to the secret at the specified path using this command devopstronaut-app vault policy write devopstronaut-app - <<EOF
path "devopstronaut/data/myapp/config" {
   capabilities = ["read"]
}
EOF vault policy write devopstronaut-app - <<EOF
path "devopstronaut/data/myapp/config" {
   capabilities = ["read"]
}
EOF Create a Vault role that permits Kubernetes service accounts to authenticate and retrieve secrets using the specified policy with the following command vault write auth/kubernetes/role/devopstronaut-app \
  bound_service_account_names=devopstronaut-app \
  bound_service_account_namespaces=default \
  policies=devopstronaut-app \
  ttl=24h vault write auth/kubernetes/role/devopstronaut-app \
  bound_service_account_names=devopstronaut-app \
  bound_service_account_namespaces=default \
  policies=devopstronaut-app \
  ttl=24h **bound_service_account_names=devopstronaut-app**: Restricts access to this specific Kubernetes service account.
**bound_service_account_namespaces=default**: Limits the access to the default namespace.
**policies=devopstronaut-app**: Associates the Vault policy named devopstronaut-app with this role.
**ttl=24h**: Sets the lifetime of the generated token to 24 hours. **bound_service_account_names=devopstronaut-app**: Restricts access to this specific Kubernetes service account. **bound_service_account_names=devopstronaut-app** **bound_service_account_namespaces=default**: Limits the access to the default namespace. **bound_service_account_namespaces=default** default **policies=devopstronaut-app**: Associates the Vault policy named devopstronaut-app with this role. **policies=devopstronaut-app** devopstronaut-app **ttl=24h**: Sets the lifetime of the generated token to 24 hours. **ttl=24h** Create a Kubernetes service account named devopstronaut-app using this command kubectl create sa devopstronaut-app devopstronaut-app kubectl create sa devopstronaut-app kubectl create sa devopstronaut-app This service account is used by your application pods to authenticate with Vault. Vault uses this service account’s identity to match it with the role you configured earlier (devopstronaut-app) and determine what secrets the pod is allowed to access based on the assigned Vault policy Vault devopstronaut-app List all the service accounts in the current Kubernetes namespace using this command kubectl get serviceaccounts kubectl get serviceaccounts kubectl get serviceaccounts Step 6: Inject secrets into the New Pod Deploy the BusyBox application using the following deployment configuration file (mahi-busybox.yaml) #mahi-busybox.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mahi-busybox-app
  labels:
    app: mahi-busybox-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mahi-busybox-app
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/role: 'devopstronaut-app'
        vault.hashicorp.com/agent-inject-secret-myapp-config.txt: 'devopstronaut/myapp/config'
      labels:
        app: mahi-busybox-app
    spec:
      serviceAccountName: devopstronaut-app
      containers:
        - name: busybox
          image: busybox:1.35
          command: ["sleep", "3600"] #mahi-busybox.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mahi-busybox-app
  labels:
    app: mahi-busybox-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mahi-busybox-app
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/role: 'devopstronaut-app'
        vault.hashicorp.com/agent-inject-secret-myapp-config.txt: 'devopstronaut/myapp/config'
      labels:
        app: mahi-busybox-app
    spec:
      serviceAccountName: devopstronaut-app
      containers:
        - name: busybox
          image: busybox:1.35
          command: ["sleep", "3600"] Execute the kubectl apply -f mahi-busybox.yaml command to deploy the application using the mahi-busybox.yaml configuration file and run kubectl get pods to get the status of the pods including busybox application kubectl apply -f mahi-busybox.yaml kubectl apply -f mahi-busybox.yaml mahi-busybox.yaml kubectl get pods kubectl get pods Run kubectl exec -it mahi-busybox-app-76b89b8967-ncwpc -- /bin/sh command to open an interactive shell inside the mahi-busybox-app-76b89b8967-ncwpc pod kubectl exec -it mahi-busybox-app-76b89b8967-ncwpc -- /bin/sh kubectl exec -it mahi-busybox-app-76b89b8967-ncwpc -- /bin/sh mahi-busybox-app-76b89b8967-ncwpc To view and verify the injected secret, run cat /vault/secrets/myapp-config.txt cat /vault/secrets/myapp-config.txt cat /vault/secrets/myapp-config.txt Step 7: Inject secrets into an Existing pod Deploy the Nginx application using the deployment configuration file named nginx-app.yaml nginx-app.yaml #nginx-app.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mahi-app
  labels:
    app: mahi-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mahi-app
  template:
    metadata:
      annotations:
      labels:
        app: mahi-app
    spec:
      serviceAccountName: devopstronaut-app
      containers:
        - name: nginx
          image: nginx:latest #nginx-app.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mahi-app
  labels:
    app: mahi-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mahi-app
  template:
    metadata:
      annotations:
      labels:
        app: mahi-app
    spec:
      serviceAccountName: devopstronaut-app
      containers:
        - name: nginx
          image: nginx:latest Execute the kubectl apply -f nginx-app.yaml command to deploy the application using the nginx-app.yaml configuration file kubectl apply -f nginx-app.yaml kubectl apply -f nginx-app.yaml nginx-app.yaml Run Kubectl get pods command to get the status of the pods including nginx application Kubectl get pods Kubectl get pods Create a YAML snippet(secret-injects.yaml) containing annotations that activate Vault Agent secret injection for the pod template #secret-injects.yaml
spec:
   template:
      metadata:
         annotations:
            vault.hashicorp.com/agent-inject: 'true'
            vault.hashicorp.com/role: 'devopstronaut-app'
            vault.hashicorp.com/agent-inject-secret-database-config.txt: 'devopstronaut/data/myapp/config' #secret-injects.yaml
spec:
   template:
      metadata:
         annotations:
            vault.hashicorp.com/agent-inject: 'true'
            vault.hashicorp.com/role: 'devopstronaut-app'
            vault.hashicorp.com/agent-inject-secret-database-config.txt: 'devopstronaut/data/myapp/config' Use kubectl patch deployment mahi-app --patch-file secret-injects.yaml command to apply the patch from the secret-injects.yaml file to the mahi-app deployment kubectl patch deployment mahi-app --patch-file secret-injects.yaml kubectl patch deployment mahi-app --patch-file secret-injects.yaml secret-injects.yaml mahi-app Run kubectl get pods command and you can see the new pods will be created with vault inject kubectl get pods kubectl get pods Run kubectl exec -it mahi-app-58d98f454f-s66tl -- /bin/sh command to open an interactive shell inside the mahi-app-58d98f454f-s66tl pod kubectl exec -it mahi-app-58d98f454f-s66tl -- /bin/sh kubectl exec -it mahi-app-58d98f454f-s66tl -- /bin/sh mahi-app-58d98f454f-s66tl Run cat /vault/secrets/myapp-config.txt command to view and verify the injected secret cat /vault/secrets/myapp-config.txt cat /vault/secrets/myapp-config.txt t Conclusion: HashiCorp Vault Agent Injector makes managing secrets in Kubernetes simple and secure. It helps deliver secrets directly into your pods without exposing them in environment variables or Kubernetes Secrets. By following the steps to set up Vault and configure your workloads, you can protect sensitive data while keeping your applications running smoothly. Using Vault this way improves security and reduces the chance of secret leaks, making it a great choice for Kubernetes deployments. Keep Learning, Keep Kubernet-ing!!! Keep Learning, Keep Kubernet-ing!!! If you found this guide helpful, give it a clap! 👏 If you found this guide helpful, give it a clap! For more insightful content on AWS,Cloud Native best practices, cloud security, devops and technology updates, don’t forget to follow me! 🚀 follow me! Feel free to reach out to me, if you have any other queries or suggestions.

Strengthen Kubernetes Security with Vault Agent Injector

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Step-by-Step Elastic Kubernetes Service (EKS) Cluster Setup with Auto Mode via AWS Console and eksctl

105 Stories To Learn About K8s

101 Stories To Learn About Cloud Infrastructure

About Ten Open Source Technologies That Are Changing the World

10 Free Courses to learn Docker and DevOps for Programmers and Software Developers

10 DevOps Conferences You Should Be Attending in 2020

Step-by-Step Elastic Kubernetes Service (EKS) Cluster Setup with Auto Mode via AWS Console and eksctl

105 Stories To Learn About K8s

101 Stories To Learn About Cloud Infrastructure

About Ten Open Source Technologies That Are Changing the World

10 Free Courses to learn Docker and DevOps for Programmers and Software Developers

10 DevOps Conferences You Should Be Attending in 2020

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps