Managing and securing Kubernetes secrets - Simon Pearce
summary
Argues that secrets belong in an external KMS and demonstrates a working setup: Secret Store CSI Driver + Helm install syncs Vault secrets into a tmpfs CSI volume, one app writes a Kubernetes Secret (stored in etcd) while the improved app reads only from the mounted volume so no secret lands in etcd. Uses Vault with Kubernetes auth and a policy-bound service account; rotation interval is configurable (demo set to 1 minute) and live reload requires either app-side re-read or pod restart.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker intro
- 3:15Current Kubernetes secrets situation
- 8:07Securing secrets in Kubernetes
- 12:44External secrets and KMS options
- 15:19Secret Store CSI driver explained
- 19:34Demo setup and prerequisites
- 22:04Vault configuration for Kubernetes
- 25:12Installing Secret Store CSI driver
- 26:57Deploying applications with secrets
- 32:40Secret rotation and updates
- 35:18Q&A session
related talks
24mCan You Keep a Secret? On Secret Management in Kubernetes
36mSecrets Store CSI Driver-Bring Your Own Enterprise Secrets Store to K8s
30mHow to Make Kubernetes Secrets Really… Secret?
20mEvolving Kubernetes security with Vault and OpenShift
29mHow to Make Kubernetes Secrets Really… Secret?
54mKeeping Kubernetes secrets secret
54mKeeping Kubernetes Secrets
31mVault and Secret Management in Kubernetes