Smooth Operator: Vault & the Kubernetes Operator Framework
summary
Proposes a service layer built as a suite of Kubernetes operators that wrap Vault APIs to provide opinionated, auditable self-service: uses Operator SDK, Vault (transit for encryption), Kubernetes auth, AWS STS, and custom resources like policy request CR and an aws secrets CR. Implements automatic 30‑day credential rotation, ownerReferences for garbage collection, and a reconciliation loop that recreates removed policies; demo shows operators create policies/roles and correctly remove them when underlying resources disappear.
AI-written summary · about
chapters (6)
- 0:00Self-service vault access
- 1:55Need for a service layer
- 2:48The kubernetes operator
- 4:58Designing the operator suite
- 7:27Demonstration and workflow
- 12:28Key takeaways
related talks
28mSelf-Service Vault in Kubernetes
41mEasy Secrets in Kubernetes: Because I Vault It Well
42mDynamic credentials for Kubernetes workloads with Vault and VSO
28mSmooth Operator - A Rough Guide to Kubernetes Operators - Olive Power, VMware
31mVault and Secret Management in Kubernetes
47mThe Secret to Handling Dynamic Secrets
49mUsing HashiCorp Vault with Kubernetes
23mHashiCorp Vault and Getting Day 2 Operations Right