Self-Service Vault in Kubernetes
summary
Move Vault from VM-hosted Terraform to a Kubernetes-native, declarative system that removes PR bottlenecks and human apply steps. Uses the open-source bank-vaults operator to create clusters from a Vault CRD, a dynamic configuration operator that edits Vault CRDs from annotated service accounts, mutating admission webhooks to auto-inject Vault Agent sidecars or tokens, and KMS-encrypted secrets decrypted in-memory by an operator so plaintext never lands in source control; integrates with OPA, Prometheus and standard K8s storage for continuous reconciliation and automated day‑2 operations.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:20"It sucks to manage Vault" starter pack
- 1:41Where we were
- 3:42Self service
- 5:31PRs are not self-service
- 6:01Point-in-time configuration
- 8:07Kubernetes operator pattern
- 10:15Kubernetes admission controllers
- 11:40Vault in Kubernetes
- 16:55Vault Dynamic Configuration Operator
- 19:22KMS Vault Operator
- 21:06Mutating Webhooks
- 23:18Vault agent auto-inject
- 24:11Vault automatic default configuration
- 24:41Unlocking potential
- 25:47We're hiring!
related talks
14mSmooth Operator: Vault & the Kubernetes Operator Framework
31mVault and Secret Management in Kubernetes
42mDynamic credentials for Kubernetes workloads with Vault and VSO
29mAutomating Vault deployments: Patterns, pitfalls, and practical lessons
49mUsing HashiCorp Vault with Kubernetes
32mIntegrating HashiCorp Vault and K8s Apps - No Code Changes Needed
23mHashiCorp Vault and Getting Day 2 Operations Right
23mUsing Hashicorp Vault in Kubernetes Clusters