Can You Keep a Secret? On Secret Management in Kubernetes
summary
Shows a practical replacement for plain Kubernetes Secrets by integrating an external store: deploys Secret Store CSI Drive plus a Vault CSI provider as two daemonsets on an EKS cluster, installed via Helm, mounts secret data into pods as a read-only file called "bar", and demonstrates retrieval and an update. Claims no code changes are required; proves mount works in the demo but notes the live secret-rotation/reload step had technical issues and needs external tooling for automatic pod reloads.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:57Overview
- 2:24What is a Secret
- 3:23Kubernetes Secrets
- 5:44Problems with Kubernetes Secrets
- 7:42What is an External Secret Provider
- 11:20What is CSI
- 12:20Architecture
- 14:02Demo
- 18:45Summary
related talks
39mManaging and securing Kubernetes secrets - Simon Pearce
30mLook Ma, No secrets in my Kubernetes Cluster! - Vijay Dharap
36mSecrets Store CSI Driver-Bring Your Own Enterprise Secrets Store to K8s
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
24mSecrets Store CSI Driver: Keeping Secrets Secret
41mOptimizing Secrets Management
30mHow to Make Kubernetes Secrets Really… Secret?
01h 02mSecret Management: The Soft Way