How to pass azure key vault secrets to kubernetes pod using file in helm charts

user_12001541 0
Viewed 2317

I am using azure key vault to save secrets and use as env variables in deployment.yaml.

but issue is I can see these secrets in azure kubernetes cluster in azure portal.

I read in kubernetes documentation that we can use these variables as file instead of env variables for more secure deployment.

What changes do I need do for achieving this

Here are my helm charts -

SecretProviderClass.yaml

apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
  name: azure-keyvault 
spec:
  provider: azure
  secretObjects:
  - secretName: database-configs
    type: Opaque
    data:
    - objectName: DB-URL
      key: DB-URL

  parameters:
    usePodIdentity: "false"
    useVMManagedIdentity: "true"
    userAssignedIdentityID: {{ .Values.spec.parameters.userAssignedIdentityID }} 
    resourceGroup: {{ .Values.spec.parameters.resourceGroup }} 
    keyvaultName: {{ .Values.spec.parameters.keyvaultName }} 
    tenantId: {{ .Values.spec.parameters.tenantId }} 
    objects: |
      array:
        - |
          objectName: DB-URL
          objectType: secret
          objectAlias: DB-URL

deployment.yaml

env:
          - name: DB-URL
            valueFrom:
              secretKeyRef:
                name: database-configs
                key: DB-URL
          volumeMounts:
          - mountPath: "/mnt/azure"
            name: volume
          - mountPath: "mnt/secrets-store"
            name: secrets-mount
            readOnly: true
      volumes:
        - name: volume
          persistentVolumeClaim:
            claimName: azure-managed-disk      
        - name: secrets-mount
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: "azure-keyvault"

file where helm substituting these values at deployment time-

settings.ini -

[server]
hostname = "localhost"
hot_deployment = false
url = "$env{DB-URL}"

[user_store]
type = "read_only_ldap"

Any help will be really appreciated.

I am looking for secure way to use key vault and kubernetes together

azure-keyvault kubernetes-secrets azure-aks kubernetes-helm azure
2 Answers

The secrets appear in the Azure Portal Kubernetes Resource View because the SecretProviderClass azure-keyvault has spec.secretObjects field. In some cases, you may want to create a Kubernetes Secret to mirror the mounted content. Use the optional secretObjects field to define the desired state of the synced Kubernetes secret objects. Reference

Removing the spec.secretObjects will prevent the sync of mounted secret content with the AKS cluster.

An environment variable is a dynamic-named value that can affect the way running processes will behave on a computer. They are part of the environment in which a process runs. These should not be confused with files.

The Kubernetes documentation says that a secret can be used with a Pod in 3 ways:

I see that your Helm Chart already has the secret volume mount set up. That leaves the last step from here:

Modify your image or command line so that the program looks for files in the directory where your secrets would appear (in this case it looks like /mnt/secrets-store). Each key in the secret data map becomes the filename under mountPath.

Note: Assuming that you missed / in:

- mountPath: "mnt/secrets-store"
user_161696040

I am still looking for a better answer, but this is what I tried.

Deployed a small dummy deployment with all secrets mapped to volume map and environment variable, matching with SecretProviderClass. This creates secrets in K8S.

Now deploying helmchart using those secrets works.

I know this is overhead to deploy unwanted things + it needs to be Highly Available. But could not find any workaround.

Looking for better answer!

user_38087210
Related