Integrating HashiCorp Vault and K8s Apps - No Code Changes Needed
summary
Shows a working, no-app-code change integration: Kubernetes auth exchanges a service account token for a Vault token, a Vault Agent sidecar writes the token to a shared volume, and envconsul or a small entrypoint injects Vault values as environment variables. Uses Terraform models to provision Vault roles, DB secret engine and a rotation-enabled DB role, includes preStop token revoke and lease renewal. Demo config runs and rotates short‑lived DB creds successfully.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:28I'm Andrey
- 2:09Agenda
- 2:33What is the problem?
- 4:30How HashiCorp Vault solves those problems?
- 5:06Baseline
- 5:56One slide Vault intro
- 10:10K8s pod/secret lifecycle overview
- 12:10Initial token - how?
- 13:55Read secrets and renew
- 15:59Revoke token
- 17:06Terraform kas part
- 19:13Deployment details
- 20:56app/init.sh
- 23:24App setup
- 29:17App module - putting it all together
- 29:44Opportunity for improvement
related talks
23mUsing Hashicorp Vault in Kubernetes Clusters
28mSelf-Service Vault in Kubernetes
49mUsing HashiCorp Vault with Kubernetes
28mSecret Management with Hashicorp´s Vault
42mDynamic credentials for Kubernetes workloads with Vault and VSO
23mVault for Secrets Management and TLS in Consul K8s
28mUsing Vault with a Laravel App in OpenShift
27mStop the (Password) Insanity! - Managing Credentials with HashiCorp Vault