How to deploy Vault for Kubernetes in 2022 and inject secrets
Source: YouTube · That DevOps Guy · published Feb 1, 2022 · 30:32
This video provides a comprehensive guide on setting up HashiCorp Vault on Kubernetes 1.21, including cluster deployment, TLS configuration, Vault installation, and secret injection capabilities 0:04.
Key Takeaways:
• Vault integration with Kubernetes uses admission controllers and requires keeping Vault updated as Kubernetes versions change 1:01.
• The demo uses Kind to create a Kubernetes 1.21 cluster since Vault's admission controller API is only supported up to this version 2:32.
• HashiCorp Consul is deployed as a storage backend for Vault using Helm charts 6:53.
• Self-signed TLS certificates are created for secure communication between Vault and other components 9:21.
• Vault is deployed using Helm and requires manual initialization and unsealing of each node 18:01.
The guide concludes by demonstrating how to automatically inject secrets from Vault into Kubernetes pods using annotations and service accounts 27:39.
Sources:
- 0:04 Introduction to the Vault and Kubernetes guide
- 1:01 Explanation of Vault's Kubernetes admission controller integration
- 2:32 Setting up Kubernetes 1.21 with Kind
- 6:53 Deploying Consul as a storage backend
- 9:21 Creating TLS certificates
- 18:01 Vault initialization and unsealing process
- 27:39(https://www.youtube.com/watch?v=2Owo4Ioo9t
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[Music] now kubernetes is constantly evolving and receiving updates almost every single day and if you're an engineer working on kubernetes you probably have to keep your clusters up to date quite regularly now some time back i've released a full series on hashicorp vault where we've taken a look at how to get a vault up and running the basics how to get tls communication between vault and all its integrations and how to create a basic secret involved and automatically injecting it into new pods as well as dynamically creating secrets in something like a postgres database automatically expiring and rotating those secrets inside of pods that require a database connection to postgres that series covers all the basic information on vault so if you're new to volt check out the description link…