AWS EKS & Secrets Manager (File & Env | Kubernetes | Secrets Store CSI Driver | K8s)
Source: YouTube · Anton Putra · published Aug 12, 2021 · 16:08
This tutorial demonstrates how to securely mount secrets from AWS Secrets Manager into Amazon EKS Kubernetes pods as both files and environment variables using the Secrets Store CSI Driver and OpenID Connect (OIDC).
Key Takeaways:
• The process begins by creating a secret in AWS Secrets Manager and setting up an EKS cluster with an OIDC provider to authorize the cluster to interact with AWS services.
1:20 - 4:59
• An IAM policy is configured to read the specific secret and an IAM Role is created, linked to the OIDC provider, with trust policies restricted to a specific Kubernetes Service Account.
4:59 - 6:45
• The Secrets Store CSI Driver and the AWS Secrets & Configuration Provider are installed to bridge Kubernetes with external secrets stores.
7:52 - 10:47
• Finally, a SecretProviderClass is defined to map the AWS secret to a Kubernetes secret, allowing a deployed Nginx pod to use the data as a file mount and environment variable.
12:20 - 15:02
The demonstration concludes with successful retrieval of the secret and its usage within the pod, illustrating a secure method for managing credentials.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
AWS Secrets Manager lets you securely retrieve
secrets for use in your Amazon EKS Kubernetes pods. In this video, we will create a secret
in AWS Secrets Manager and then create a simple nginx deployment to demonstrate how
those secrets can be used. We will mount the secret as a file as well as we will expose
it to the pod via an environment variable. To achieve that, we will deploy Kubernetes
Secrets Store CSI Driver and an AWS component AWS Secrets Manager and Config
Provider. Working together, they will let you retrieve the secret and provide
it to the pod. To configure access, we will create an OpenID connect provider and associate the
IAM role with the Kubernetes service account. Let's get started. You can find the source code
and the commands in my GitHub repository in the re…