Dynamic credentials for Kubernetes workloads with Vault and VSO
summary
Deploys Vault outside a cluster and uses Vault Secrets Operator plus Helm, Docker, minikube and kubectl to turn Vault secrets into native Kubernetes Secrets. Demonstrates both a static KV secret and dynamic Postgres credentials via the database secrets engine, creating service accounts, roles and policies; Vault issues short‑lived DB users that the app successfully uses. Also shows a client cache encrypted with the transit engine and notes instant update/event watching requires Vault Enterprise.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:34Lab prerequisites
- 3:01Why dynamic credentials
- 4:48Setting up Vault externally
- 10:03Starting the demo environment
- 13:17Installing Vault Secrets Operator
- 16:06Configuring Kubernetes auth
- 18:24Testing static secrets
- 24:27Deploying the test app
- 26:49Introducing dynamic secrets
- 28:13Configuring PostgreSQL engine
- 31:25Deploying dynamic secret
- 33:12Testing dynamic credentials
- 35:39Q&A
- 35:59Bonus client cache setup
related talks
23mUsing Hashicorp Vault in Kubernetes Clusters
47mThe Secret to Handling Dynamic Secrets
20mEvolving Kubernetes security with Vault and OpenShift
31mVault and Secret Management in Kubernetes
28mSelf-Service Vault in Kubernetes
31mModern Security with Microservices and the Cloud
41mEasy Secrets in Kubernetes: Because I Vault It Well
49mUsing HashiCorp Vault with Kubernetes