Effortless Secrets Management in Kubernetes
summary
GitOps with Argo CD deploys a sample “school app” (JS frontend, FastAPI backend, MongoDB) and then Vault is added using the Vault Agent Sidecar Injector which mutates pods to mount a shared volume and inject init/sidecar agents; Vault uses Kubernetes auth and a role with TTL 5s / maxTTL 20s. Secrets live in KV v2 and are rendered by templates into files (username, password and token) under app-secrets, and the app runs successfully reading credentials from Vault instead of git.
AI-written summary · about
chapters (17)
- 0:00intro
- 1:43preamble
- 1:58intro to gitops with argocd
- 3:38school app introduction
- 4:24school app components
- 5:37school app k8s output
- 6:04add vault to the school app
- 6:52kubernetes auth method
- 8:51the vault agent sidecar injector overview
- 12:02mutation effects
- 13:22vault agent config to render secrets
- 13:55school app annotations example
- 14:58vault agent templates overview
- 15:35vault agent templates workflow
- 16:32vault agent templates with annotations
- 18:04demo
- 47:23thank you
related talks
35mShh, It’s a Secret: Managing Your Secrets in a GitOps Way
14mExploring HashiCorp Vault and ArgoCD the GitOps Way
25mGitOps and Secrets: State of the Union
10mLightning Talk: Exploring HashiCorp Vault and ArgoCD - the GitOps Way
29m100,000 Different Ways to Manage Secrets in GitOps
01h 03mSecuring Legacy Applications and Container Microservices in Kubernetes
23mUsing Hashicorp Vault in Kubernetes Clusters
41mEasy Secrets in Kubernetes: Because I Vault It Well