从 POD 访问 GCP 机密管理器中的机密

Question

Some secrets need to be fetched by the PODS, secrets are stored in GCP secret manager, what is the secure and efficient way to fetch the secrets within the pod ?

Thank you !

Answer 1

There isn't a native integration between Kubernetes Secrets and Google Secret Manager. As described in the documentation , the best solution is to use the Secret Manager client library to interact with secret manager and especially to access them.

At the security point of view, using Workload Identity is also the best solution to use a specific service account for your deployment and then enforce the least privilege principle.

If you don't do that, you will use, by default, the Node service account (this one on the Compute Engine) and you will have to grant this service account to access the secrets. And, because it's the NODE identity, all the pods running on these nodes will have the same permissions and will be allowed to access the secrets!