Integrate HashiCorp Vault with Kubernetes secrets management for secure container orchestration

Configure Vault Kubernetes authentication

Set up the Kubernetes authentication method in Vault to allow pods to authenticate using service account tokens.

export VAULT_ADDR="https://vault.example.com:8200"
export VAULT_TOKEN="your-vault-token"

Enable Kubernetes authentication method
vault auth enable kubernetes

Extract Kubernetes cluster information

Gather the necessary cluster details that Vault needs to validate service account tokens.

# Get the Kubernetes API server URL
KUBE_API_URL=$(kubectl config view --raw --minify --flatten -o jsonpath='{.clusters[].cluster.server}')

Extract the service account token reviewer JWT
KUBE_SA_TOKEN=$(kubectl get secret -n kube-system -o jsonpath='{.items[?(@.metadata.annotations.kubernetes\.io/service-account\.name=="default")].data.token}' | base64 --decode)

Get the certificate authority
KUBE_CA_CERT=$(kubectl config view --raw --minify --flatten -o jsonpath='{.clusters[].cluster.certificate-authority-data}' | base64 --decode)

Configure Vault with Kubernetes cluster details

Configure the Kubernetes authentication method with your cluster's connection information.

vault write auth/kubernetes/config \
    token_reviewer_jwt="$KUBE_SA_TOKEN" \
    kubernetes_host="$KUBE_API_URL" \
    kubernetes_ca_cert="$KUBE_CA_CERT" \
    disable_iss_validation=true

Create Vault policies for Kubernetes access

Define policies that control what secrets Kubernetes applications can access.

path "secret/data/myapp/*" {
  capabilities = ["read"]
}

path "database/creds/myapp-role" {
  capabilities = ["read"]
}

path "auth/token/renew-self" {
  capabilities = ["update"]
}

# Apply the policy to Vault
vault policy write myapp-policy /tmp/app-policy.hcl

Create Kubernetes authentication role

Configure a role that maps Kubernetes service accounts to Vault policies.

vault write auth/kubernetes/role/myapp-role \
    bound_service_account_names=myapp-sa \
    bound_service_account_namespaces=default,production \
    policies=myapp-policy \
    ttl=1h

Install Vault CSI driver

Deploy the Vault CSI driver using Helm to enable secret injection as mounted volumes.

# Add HashiCorp Helm repository
helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo update

Install Vault CSI driver
helm install vault-csi-provider hashicorp/vault-csi-provider \
    --namespace vault-system \
    --create-namespace \
    --set "vault.address=${VAULT_ADDR}"

Install Vault Secrets Operator

Deploy the Vault Secrets Operator for automatic Kubernetes secret synchronization.

# Install Vault Secrets Operator
helm install vault-secrets-operator hashicorp/vault-secrets-operator \
    --namespace vault-secrets-operator-system \
    --create-namespace

Configure Vault connection for the operator

Create a VaultConnection resource that defines how the operator connects to Vault.

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultConnection
metadata:
  name: default
  namespace: vault-secrets-operator-system
spec:
  address: https://vault.example.com:8200
  skipTLSVerify: false

kubectl apply -f vault-connection.yaml

Create service account for applications

Set up a Kubernetes service account that will authenticate with Vault.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: myapp-sa
  namespace: default
---
apiVersion: v1
kind: Secret
metadata:
  name: myapp-sa-token
  namespace: default
  annotations:
    kubernetes.io/service-account.name: myapp-sa
type: kubernetes.io/service-account-token

kubectl apply -f service-account.yaml

Create sample secrets in Vault

Add some test secrets to Vault that your applications will consume.

# Enable KV secrets engine if not already enabled
vault secrets enable -path=secret kv-v2

Create sample application secrets
vault kv put secret/myapp/config \
    db_host="db.example.com" \
    db_port="5432" \
    api_key="super-secret-api-key"

vault kv put secret/myapp/credentials \
    username="myapp-user" \
    password="secure-password-123"

Configure CSI driver secret injection

Create a SecretProviderClass that defines which secrets to mount and how to format them.

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: vault-myapp
  namespace: default
spec:
  provider: vault
  parameters:
    vaultAddress: "https://vault.example.com:8200"
    roleName: "myapp-role"
    objects: |
      - objectName: "db_host"
        secretPath: "secret/data/myapp/config"
        secretKey: "db_host"
      - objectName: "db_port"
        secretPath: "secret/data/myapp/config"
        secretKey: "db_port"
      - objectName: "api_key"
        secretPath: "secret/data/myapp/config"
        secretKey: "api_key"
      - objectName: "username"
        secretPath: "secret/data/myapp/credentials"
        secretKey: "username"
      - objectName: "password"
        secretPath: "secret/data/myapp/credentials"
        secretKey: "password"
  secretObjects:
  - secretName: myapp-secret
    type: Opaque
    data:
    - objectName: "db_host"
      key: "DB_HOST"
    - objectName: "db_port"
      key: "DB_PORT"
    - objectName: "api_key"
      key: "API_KEY"
    - objectName: "username"
      key: "USERNAME"
    - objectName: "password"
      key: "PASSWORD"

kubectl apply -f secret-provider-class.yaml

Deploy application with CSI driver

Create a pod that uses the CSI driver to mount secrets from Vault.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-csi
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp-csi
  template:
    metadata:
      labels:
        app: myapp-csi
    spec:
      serviceAccountName: myapp-sa
      containers:
      - name: myapp
        image: nginx:alpine
        volumeMounts:
        - name: secrets-store
          mountPath: "/mnt/secrets"
          readOnly: true
        env:
        - name: DB_HOST
          valueFrom:
            secretKeyRef:
              name: myapp-secret
              key: DB_HOST
        - name: DB_PORT
          valueFrom:
            secretKeyRef:
              name: myapp-secret
              key: DB_PORT
        command: ["/bin/sh"]
        args: ["-c", "while true; do echo 'App running with secrets'; sleep 30; done"]
      volumes:
      - name: secrets-store
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: "vault-myapp"

kubectl apply -f app-with-csi.yaml

Configure Vault Secrets Operator authentication

Create a VaultAuth resource for the Secrets Operator to authenticate with Vault.

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: default
  namespace: default
spec:
  vaultConnectionRef: vault-secrets-operator-system/default
  method: kubernetes
  mount: kubernetes
  kubernetes:
    role: myapp-role
    serviceAccount: myapp-sa

kubectl apply -f vault-auth.yaml

Create VaultStaticSecret for operator

Configure the Secrets Operator to sync static secrets from Vault to Kubernetes secrets.

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: myapp-config
  namespace: default
spec:
  vaultAuthRef: default
  mount: secret
  type: kv-v2
  path: myapp/config
  destination:
    name: myapp-config-secret
    create: true
  refreshAfter: 30s
  rolloutRestartTargets:
  - kind: Deployment
    name: myapp-operator

kubectl apply -f vault-static-secret.yaml

Deploy application using operator-managed secrets

Create a deployment that consumes secrets managed by the Vault Secrets Operator.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-operator
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp-operator
  template:
    metadata:
      labels:
        app: myapp-operator
    spec:
      serviceAccountName: myapp-sa
      containers:
      - name: myapp
        image: nginx:alpine
        env:
        - name: DB_HOST
          valueFrom:
            secretKeyRef:
              name: myapp-config-secret
              key: db_host
        - name: DB_PORT
          valueFrom:
            secretKeyRef:
              name: myapp-config-secret
              key: db_port
        - name: API_KEY
          valueFrom:
            secretKeyRef:
              name: myapp-config-secret
              key: api_key
        command: ["/bin/sh"]
        args: ["-c", "while true; do echo 'Operator app running'; env | grep -E '(DB_|API_)'; sleep 30; done"]
        ports:
        - containerPort: 80

kubectl apply -f app-with-operator.yaml

Configure dynamic database secrets

Set up Vault to generate dynamic database credentials for enhanced security.

# Enable database secrets engine
vault secrets enable database

Configure database connection (example with PostgreSQL)
vault write database/config/myapp-db \
    plugin_name=postgresql-database-plugin \
    connection_url="postgresql://{{username}}:{{password}}@db.example.com:5432/myapp?sslmode=require" \
    allowed_roles="myapp-role" \
    username="vault" \
    password="vault-db-password"

Create database role for dynamic credentials
vault write database/roles/myapp-role \
    db_name=myapp-db \
    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
    default_ttl="1h" \
    max_ttl="24h"

Create VaultDynamicSecret for database credentials

Configure the operator to manage dynamic database credentials with automatic rotation.

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  name: myapp-db-creds
  namespace: default
spec:
  vaultAuthRef: default
  mount: database
  path: creds/myapp-role
  destination:
    name: myapp-db-secret
    create: true
  renewalPercent: 90
  rolloutRestartTargets:
  - kind: Deployment
    name: myapp-db

kubectl apply -f vault-dynamic-secret.yaml