如何从 Kubernetes 将秘密写入 HashiCorp Valut 或 Azure Key Vault？

Question

I have come across injectors/drivers/ et cetera for Kubernetes for most major secret providers, but the common theme with those solutions are that these only sync one-way, ie, only from the vault to the cluster. I want to be able to update the secrets too, from my Kubernetes cluster.

What is the recommended pattern for doing this? (Apart from the obvious solution of writing a custom service that communicates with the vault)

Answer 1

I'd say that this is an anti pattern, meaning you shouldn't do that.

If you create your secret in k8s from file, that would mean you either have it in version control, something you should never do. Or you don't have it in version control or create it from literal, which is good, but than you neither have a change history/log nor a real documentation of your secret. I guess that would explain, why the major secret providers don't support that.

You should set up the secret using the key vault and apply it to your cluster using Terraform for example.

Terraform supports both azure key vault secret https://www.terraform.io/docs/providers/azurerm/r/key_vault_secret.html and Kubernetes secrets https://www.terraform.io/docs/providers/kubernetes/r/secret.html

You can simply import the key vault secret and use it in the k8s secret. Every time you update the key vault secret, you apply the changes with Terraform.