►
Description
How critical is security in a cloud-native infrastructure? Rosemary Wang from HashiCorp joins us in this episode to discuss using Vault as a secret management system for Kubernetes. This is a big topic, and Rosemary is gracious enough to walk us through every detail of HashiCorp Vault. Are you new to Vault? HashiCorp Vault is a secrets management tool created primarily to control access to sensitive credentials in a low-trust environment. It can be used to manage secrets, encryption as a service, and privileged access. So join us to learn more about how implementing a product like HashiCorp Vault may provide you better control over sensitive credentials while also helping meet cloud security standards.
Learn more:
https://www.vaultproject.io/
Follow us:
Christian Hernandez https://twitter.com/christianh814
Rosemary Wang https://twitter.com/joatmon08
What is GitOps Guide to the Galaxy?
Every other Thursday at 3pm ET hosts Christian Hernandez and Chris Short sit down to discuss everything in the GitOps universe, from end-to-end CICD pipelines to creating Git workflows.
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
Openshift.com https://red.ht/33Fh6uV
OpenShift on github https://github.com/openshift/
OpenShift on redhat.com https://red.ht/2o4ccDk
#RedHat #GitOps #Kubernetes
A
All
right
and
we
are
live-
welcome
everyone
to
another
episode
of
get
off's
guide
to
the
galaxy.
I
will
be
your
captain
in
this
journey.
Christian
hernandez
here,
technical
marketing
at
red
hat
and
my
co-captain
today
is-
should
be
pointing
the
right,
a
very
special
guest
here.
I
should
point
to
that.
It's
always
married,
so
I'm
not
sure
here
is.
C
Yeah,
I'm
here
to
help
you
navigate
the
terrifying
waters
of
secrets,
man
aka.
How
do
you
not
accidentally
show
your
password
to
everybody?
So
I'm
a
developer
advocate
at
hashicorp.
I've
worked
quite
a
bit
in
various
roles.
Networking
cloud
other
work
on
I've
been
working
on
a
book
called
about
infrastructure
as
code,
so
pretty
much
defined
my
career
as
a
jack
of
all
trades
and
master
of
absolutely
none
of
them.
A
A
Well,
you
know
what
it's
it's
good
that
you
you
know
it's
one
of
those
things
that
you
learn
from
your
mistakes
right
and
then
you
become
a
really
good
advocate.
I
think
the
the
best
advocates
are
the
ones
who've
made
the
mistake
before
right,
because
you're
always
I've
been
in
your
shoes
before
so
again,
you
know
very
excited
to
have
rosemary
on
it's.
It's
been,
you
know
I've.
The
question
I
constantly
get
asked
all
the
time
is
about
secrets
and
get
ups,
and
since
it's
a
get
ups,
there's
a
get.
A
Ups
show
here.
It's
like
a
topic
that
always
comes
up
like
if
you
know
I.
I
was
not
sure
if
you
were
here
at
kubecon
when
it
was
here
in
la,
but
people
were
constantly
stopped
doing
hallway
things
in
the
hallway
track
sort
of
things
where
they
were
telling.
You
know
they're
asking
me
okay,
you
know,
you
know,
you
know,
love
the
stream,
so
secrets
management
and
then
it'd
be
the
the
first
thing.
I'm
pretty
sure
I
mean
I
guess.
Besides
terraform
you
know,
vault
is
probably
really
popular
over
at
hashicorp.
C
B
C
Many
ways
it
breaks
get
offs
right
because
you're
using
a
mutable
approach,
you're
treating
secrets
mutably
when
you
rotate
them
dynamically
and
that
breaks
sort
of
this
declarative
infrastructure
as
code
immutable
approach.
And
so
it's
a
really
interesting
tension
between
the
two.
But
the
whole
purpose
of
alt
is
basically
to
store,
manage
these
secrets,
secure
them,
but
also
rotate
them
for
you
and
revoke
them.
According
to
the
rules
that
you
set.
A
A
You
know
I'm
deep
in
the
get
ups
world
and
it's
always
something
that
we're
constantly
talking
about
just
constantly,
even
if
you
covered
it
before
people
just
keep
asking-
and
you
know
it's
it's
constantly
going
on
here
so
before
you
know,
I
kind
of
hand
the
hand
the
helm
here-
hand
the
reins
over
to
rosemary.
I
do
want
to
go
over
a
couple
of
a
couple
of
things.
Real,
quick
one
is
the
cfp
for
get
out.
Con
is
still
open.
A
I
put
the
link
there
in
the
chat,
so
go
ahead
and
you
know
drop
in
the
chat.
It's
it's
open
until
valentine's
day.
Actually,
it's
the
last
day
so
cp
closes
in
in
a
couple
weeks.
The
you
know
being
part
of
the
program
committee
I
can
tell
you
is
that
we're
gonna
have
two
tracks
this
time
around,
so
you
know
more
of
a
chance
for
you
for
your
talk
to
be
submitted.
So
please
feel
free
to
submit
a
talk
rosemary.
Maybe
you
can
submit
a
talk.
A
Maybe
I'll
see
you
there
in
in
spain
who
knows
right:
secret
management,
I'm
pretty
sure
there'll
be
a
ton
of
people
in
that
talk.
If
you
decide
to
do
that
so
again,
yeah
get
up
con.
This
is
gonna,
be
our
third
one,
so
so
crazy.
How
fast
this
has
grown
so
see.
If
he's
still
open.
You
know
check
that
out
and
also
another
thing
is
that
last
last
week
yesterday,
it
feels
like
last
week
it's
just
those
these
weeks.
These
weeks
have
been
what.
C
A
Yeah,
what
is
time
who
knows
waleed
yeah
it
walid
asks
by
the
way
wally's
one
of
our
regular
viewers.
Here
he
asks.
Does
this
mean?
Are
you
coming
to
spain?
Actually,
yes,
I
am
coming
to
spain
so
being
part
of
the
program
committee
and
being
part
of
red
hat
I'll,
be
there
for
kubecon
and
for
this
day,
zero
event.
A
A
I
know
rosemary
said
that
we'll
need
about
an
hour
and
we'll
probably
go
over
so
so
so
without
without,
I
guess,
further
ado
I'll
I'll
hand
the
reins
over
to
to
rosemary
to
start,
and
if
you
guys,
if
you
have
any
questions,
feel
free
to
drop
it
in
the
chat
I'll
I'll
I'll,
send
them
over,
and
you
know
I'll
I'll
step
back
here,
because
really
everyone
now
is
just
waiting
to
hear
about
and
talk
about,
vault.
So.
C
C
Great
everybody
gets
really
excited
for
it
yeah.
So
I
guess
we
it's
a
two-part
series,
because
I
told
christian
that
it
was
a
it's
a
lot
to
talk
about
vault
and
if
you
don't
or
you
haven't
used
vault
before
there
are
a
lot
of
concepts
and
a
lot
of
terms.
My
goal
is
that,
hopefully,
by
the
end
of
this,
you
look
at
some
of
these
terms
and
they're
a
little
bit
less
intimidating
you're
at
least
going
to
identify
the
workflow
right.
C
C
You
can
still
connect
to
a
vault
server
and
retrieve
secrets,
but
it's
just
not
in
a
kubernetes
cluster
today
I
will
show
it
in
a
kubernetes
cluster.
It
will
run
in
its
own
namespace,
but
there
are
ways
that
you
can
set
up,
vault
that
are
outside
of
the
kubernetes
cluster
as
well,
and
you
can
still
connect
to
it
from
kubernetes.
So
there's
a
caveat
to
all
of
that.
C
I
won't
go
too
far
into
vault
architecture,
but
there's
two
pieces
to
vaults
architecture.
The
first
is
a
vault
server
and
then
it's
the
vault
clients
right
so
vault
server
is
the
control
plane.
It
houses
all
of
the
secrets.
It
manages
and
stores
and
encrypts
any
of
the
secrets
and
you'll
see
some
of
that
today,
as
I
deploy
it
on
kubernetes,
there
are
also
clients
and
agents.
The
clients
and
agents
read
information
about
specific
secrets
so
that
you
can
proxy
it
to
an
application.
C
A
Will
start
okay
and
then
and
then
and
there's
there's
also
a
pretty
good
question
here
is
about
the
and
I'm
not
sure
if
you're
going
to
go
over
this,
but
what
the
pros
and
cons
of
having
it
external
versus
internal
you
know
outside
of
a
kubernetes
cluster
versus
having
it
internal.
You
know,
is
you
know,
I'm
pretty
sure,
there's
pros
and
cons,
but
are
you
gonna
kind
of
go
over?
You
know
what
those
are.
C
I
wasn't
gonna
go
do
that,
but
I
can
certainly
answer
that
now.
I
think
it's
a
great
question
so
there
are.
There
are
some
reasons
why
folks
don't
want
to
run
it
in
kubernetes,
for
example,
right
they
want
to
isolate
this
onto
a
certain.
You
know
subset
of
machines
from
a
multi-tenancy
perspective.
They
want
to
make
sure
they
lock
it
down.
C
Vault
has
a
couple
different
storage
options
right,
so
when
vault
has
that
information
has
secrets
has
configuration,
it
needs
to
store
it
somewhere
and
so
that
storage
mechanism,
that
storage
back
end
can
differ
depending
on
how
you
set
it
up,
and
so
some
folks
who
don't
necessarily
want
to
run
it
on
kubernetes
because
well
in
kubernetes,
we
run
it,
it's
integrated
storage.
Perhaps
they
want
to
use
something
else
as
a
back-end,
they
could
use
hashicorp
console
as
a
backend.
C
They
can
use
some
other
database
so
for
those
who
don't
want
to
necessarily
run
it
as
an
integrated
storage
option,
they
choose
to
run
it
outside
of
the
kubernetes
cluster,
something
very
predictable
from
a
virtual
machine
option
that
they're
used
to
managing
other
times
they're,
trying
to
proxy
secrets
that
are
not
related
to
kubernetes
right.
So
in
an
environment
that
doesn't
always
involve
a
kubernetes
cluster,
you
might
choose
to
manage
the
secrets
for
many
other
things:
databases,
for
example.
C
C
So
there
are
a
couple
reasons
why
you
would
run
it
external
from
an
access
point,
as
well
as
a
security
point
depends
on
your
posture
now
as
to
why
you
would
run
it
internal.
It's
pretty
easy
to
install
it
on
kubernetes,
there's
a
little
bit
of
friction
in
terms
of
upgrade
and
management,
but
if
you're
familiar
with
kubernetes
and
you're
familiar
with
managing
and
upgrading
some
stateful
components
that
you're
deploying
onto
your
kubernetes
cluster.
C
The
pattern
is
there
for
you
and
it's
a
little
bit
easier
for
you
to
manage
because
you're
familiar
with
that
kind
of
approach
on
kubernetes
right.
So
there
are
pros
and
cons
to
both.
There
is
a
link.
I
will
try
to
get
that
flow
to
you
when
I
have
more
windows,
and
I
can
find
the
link
to
you
that
describes
it
in
far
more
detail
and
some
of
the
considerations
from
a
security
and
a
storage
perspective,
as
well
as
from
a
kubernetes
perspective
as
well.
A
Yeah,
I
think
a
lot
of
I
think
you
have
to
keep
in
mind
that
that
vault
is
a
secret
management
platform,
almost
right,
independent
of
kubernetes,
so
you
can
use
it
with
kubernetes,
but
you
can
also
use
it
for
everything
else
in
your
environment.
So
I
think
that's
where
I
know
in
the
way
way.
In
the
beginning,
I'm
showing
kind
of
my
ignorance.
A
I
thought
it
was
like
a
kubernetes
specific
thing
and,
as
I
read
more
about
it
like
oh
no,
this
is
just
like
just
generic
like
you
know,
if
you
have
a
secret
management
system
you're
going
to
want
to
use
it,
you
know
for
your
for
your
entire
enterprise.
So
so
that's
you
know
kind
of
something
else.
To
keep
in
mind.
Am
I
using
this
for
kubernetes?
I
think
that's
another.
Maybe
another
consideration
am
I
using
this
specifically
for
kubernetes.
Am
I
just
gonna
use
it
in
general?
A
C
Yeah-
and
I
think
it's
also
a
couple
folks
use
vault-
you
secret-
want
secrets
management
on
edge
right
on
edge
computing
as
well.
So
you
can't
run.
You
can't
run
anything
process,
heavy
right
on
on
edge
networks
or
edge
computing.
So
the
result
is
that
it
makes
a
lot
of
sense
to
say.
Let
me
run
the
server
somewhere
else
and
then
on
the
edge,
if
you
are
using
kubernetes
on
the
edge,
I
just
run
the
clients
and
access
the
information
from
vault
right.
C
A
C
Exactly
yeah,
so
in
this
situation
I
will
be
deploying
vault
the
server
and
the
entire
platform
and
self-contained
on
kubernetes.
So
keep
that
in
mind
some
of
the
things
that
you'll
see
today
I'll
show
some
of
the
secure
way
to
do
it.
But
it's
not
going
to
be
everything
you
can
do
to
secure
vault
on
kubernetes
either.
So
keep
that
in
mind.
B
C
Okay,
yes,
oh
yeah,
yay!
I
don't
know
what
is
going
on
with
this
today.
What
I'm
going
to
do
is
I'm
going
to
send
a
live
share
to
you
christian
and
if
you
open
it
up
on
your
screen-
and
you
see
that
it's
better,
then
maybe
we
try
your
screen
share
and
at
least
that
way
folks
can
see.
What's
going
on
yeah,
so
I'll
narrate,
while
christian
tries
to
join
the
live
share
so
the
effectively
what
I've
done
is
used
a
I'm
using
crc.
So
it's
all
on
my
machine.
C
This
is
not
a
live
cluster,
so
we've
reduced
any
network
related
activity,
but
I've
created
two
namespaces
one
is
for
vault
and
one
is
for
my
application,
which
I
fondly
call
expenses.
It's
an
expense
report
api,
it's
not
the
most
glamorous
api,
but
it
returns
expenses
that
you
log
and
we're
using
that
today,
because
expenses
is
a
java
application
that
retrieves
information
from
mysql.
C
C
C
B
A
B
A
B
C
A
B
C
See
on
screen
is
the
flies.
There
are
flies
everywhere.
Okay,
all
right.
So
the
first
thing
we're
going
to
do.
As
I
mentioned
before
I
created
two
separate
namespaces,
one
is
for
vault
and
one
will
be
for
my
application.
You
do
probably
want
to
put
vault
in
its
own
namespace
from
a
component
view.
There's
not
too
many
components
to
it.
But
then
again
you
know
you
want
to
make
sure
you're
you're
securing
it
and
you're
isolating
it
to
a
specific.
C
You
know
specific
namespace
in
kubernetes,
so
the
first
thing
we're
going
to
do
is
well
the
first.
The
very
first
thing,
which
is
install
vault
vault,
runs
as
a
helm
chart,
and
so
you
can
imagine
that
it's
a
helm
install.
So
I'm
going
to
start
the
install
and
that
way
we
can
have
some
some
of
this
up,
but
I'm
just
pinning
the
version
of
the
vault
helm
chart
as
well
and
we're
going
to
deploy
a
couple
other
things.
C
So
I'm
just
going
to
copy
this
command.
So
you
don't
have
to
watch
me
type,
but
there's
two
things
I'm
going
to
be
installing
today
and
the
reason
why
I'm
installing
two
things
via
helm
is
that
there's
two
different
ways:
you
can
inject
secrets
into
your
kubernetes
applications
and
so
one
is
called
the
vault
agent.
So
if
you
deploy
the
helm
chart
by
default,
that
is
actually
the
configuration
it
will
support.
C
So
it
will
give
you
the
vault
agent
injector,
it's
using
a
mutating
web
hook
to
inject
a
side
car
into
any
application
that
needs
the
vault
vault
agent.
There's
a
second
way
that
you
can
do
it,
which
is
called
the
secret
store,
csi
provider
driver,
sorry
driver
and
what
happens
with
the
csi
secret
store.
Sorry
serious
secret
store,
csi
driver
is
that
you
don't
have
a
sidecar
agent,
so
you
can
imagine
now
we're
going
to
have
an
architectural
discussion
about
why
you
would
have
an
agent
versus
one
that
you
don't
have
an
agent.
C
C
C
The
first
thing
is
that
the
vault
helm
chart
does
deploy
on
openshift.
There
are
some
open
shift,
specific
configurations,
so
naturally,
one
of
the
values
you'll
have
to
set
is
open
shift.
True,
so
that
keep
that
in
mind
there's
also
a
couple
of
images
that
you
can
add
as
well.
These
are
specific
to
the
red
hat
registry,
so
this
is
pinning
to
vault
1.9
and
then
there's
a
couple
of
injector
images
that
you're
going
to
require.
Vault
k-8s
is
a
special
image.
C
It's
used
to
retrieve
do
authentication
and
retrieve
the
secrets
for
your
application
right,
so
keep
in
mind
that
a
lot
of
the
orchestration
will
come
from
the
vault
k-8s
binary
here
and
then
vault
itself.
The
vault
binary
is
needed
so
that
it
can
actually
retrieve
do
api
calls
against
fault.
So
there's
a
couple
images
that
you'll
need
and
then
one
thing
that
I
set:
that
is
something
unique
to
this
particular
values
file.
Is
I'm
setting
aj
enabled
true.
C
If
you
use
the
helm
chart,
you
have
two
options
you
can
set
vault
in
dev
mode.
Vault
in
dev
mode
is
really
useful
for
testing.
You
can
bring
it
up
and
you
can
work
all
you
know
work
on
it
right,
but
it
doesn't
give
you
a
good
sense
of
how
you
operate
vault.
There
are
some
security
measures
that
are
disabled
as
part
of
the
dev
mode
for
vault
server.
So,
as
a
result,
I'm
going
to
show
you
the
non-disabled
true
true
production,
not
true
production,
but
almost
production
configuration.
C
It's
a
bit
of
a
misnomer,
I
was
you
know,
I
thought
it.
I
was
like.
Oh
maybe
I'll
just
deploy
a
three
node
cluster
and
like
really
do
true
aj,
and
then
I
was
like
the
complexity
there
we're
going
to
remove
the
complexity
of
that,
but
it
is
a
vault
server.
It
will
run
one
instance
and
the
other
thing
that
it
will
do
is
run
integrated
storage.
So
I
mentioned
before:
vault
has
a
couple:
different
storage
back
ends
that
you
can
choose
the
one
that
we
recommend
on
kubernetes
is
integrated
storage.
C
A
C
C
A
C
C
Probably
yeah
just
because
our
faces
are
in
the
way,
yeah
perfect.
Thank
you.
So
when
I
get
the
pods
you'll
notice
that
there's
two
two
vault
pods
running
one
is
the
asian
ejector,
as
I
mentioned
before,
this
is
what
is
detecting
for
any
applications
or
annotations
that
need
applications
with
annotations
that
need
a
vault
agent,
so
it
will
inject
it
for
you
and
then
there's
this
vault
zero.
This
is
the
vault
server
right.
Vault
is
deployed
as
a
stateful
set.
So
you
see
this
vault
zero
and
there's
something
that's
not
very
promising.
C
C
Vault,
when
you
first
bring
it
up
when
any
time
you
restart
it
anytime,
you
know
something:
an
outage
happens:
vault
will
come
up
sealed,
so
it
will
seal
itself
and
it
encrypts
all
the
data
at
rest.
Now
it
does
encrypt
it.
You
know
at
rest
anyway,
but
this
is
actually
like
sealing
vault
itself.
It's
encrypting
vault
itself
right,
so
you
cannot
access
that
data.
You
can't
access
anything
for
the
vault
config
until
you
unseal
it
right.
So
it's
a
fail-safe
mechanism.
C
If
someone
decides
to
restart
the
thing
they
can't
acc
just
go
in
and
access
the
secrets
you
have
to
unseal
vault,
and
this
is
the
infamous
unseal
process
in
vault
it's,
as
I
mentioned,
like
launch
codes,
you
have
to
distribute
these
unsealed
keys
to
various
parties
and
the
different
people
who
have
these
keys
have
to
come
in
and
issue
a
effectively
a
vault
operator
unseal
with
the
key,
so
I'll
actually
go
through
that
process.
It
sounds
very
complicated.
I
will
go
through
this
because
it
is
quite
complicated
and
it's
a
manual
step.
C
C
That's
correct,
so
what
I'm
doing
is
I'm
running
something
called
operator
in
init.
What
this
does
is
initialize
vault,
the
vault
instance.
You
don't
have
to
run
this.
If
you
already
have
like
data
vault
data,
you
only
need
to
run
this.
If
you
have
a
new
vault
server
and
a
new
vault
instance
in
a
new
vault
cluster,
I
am
not
going
to
show
you
my
unsealed
keys,
because
that
would
be
dangerous.
C
Would
be
very
bad,
you
might
actually
see
some
of
them,
but
for
the
most
part,
I'm
saving
them
into
a
file,
I'm
not
letting
them
print
out
to
the
screen.
So
you
don't
see
my
unsealed
keys,
but
in
you
look
at
let's
say
vault
status.
Yes,
I'm
going
into
the
container
the
vaults,
the
vault
server
yeah.
C
So
the
sealed
is
true
right.
So
this
means
that
I've
initialized
it,
but
the
vault
instance
is
completely
sealed.
So
no
one
can
really
access
it.
I
can't
write
anything
to
it.
I
can't
read
anything
from
it,
so
what
I'm
going
to
do
is
I'm
going
to
unseal
it
and
the
way
you
unseal
vault
involves
a
command
called
vault
operator
unseal.
C
When
you
run
vault
operator
unseal,
it
will
ask
you
for
an
unsealed
key
in
which
you
shall
include
that
and
when
you
do,
I
have
pasted
it.
You
can't
see
it
because
it
was
hidden,
but
when
you
do
that,
you'll
notice
that
it
says
unseal
progress
one
out
of
three,
so
you
can
set
up
vault
to
have
any
number
of
unsealed
keys.
You
want,
if
you
decide
that
you
want
10
people
in
your
organization
to
have
the
keys
and
10
people
must
unseal
it.
C
B
A
C
A
C
B
A
C
Yeah-
and
I
was
like
I
don't
know-
if
that's
some
people
do
that
so
now-
you'll
notice-
that
the
sealed
is
false.
That
means
that
we've
unsealed
vault
the
process
is
called
shamir's
secret
sharing.
So
if
you
want
to
learn
more
about
that
fault,
documentation
has
plenty
of
interesting
information
about
the
theory
behind
it.
C
There
is
an
easier
way
to
do
this.
It's
called
auto
unseal.
I
did
allude
to
that
before
auto
and
seal
allows
you
to
store
this
effectively
store
the
unsealed
keys
in
a
back
end
of
your
choice
and
something
you
could
do.
Let's
say:
like
google
google's
key
management,
aws
key
management,
you
can
hsn,
you
can
do
a
lot
of
different
key
management
options
and
what
you'll
do
is
use
the
key
to
unseal
vault
right.
C
So
when
you
deploy
this
on
kubernetes,
you
can
configure
it
to
use
auto
unseal
with
the
key
management
backend
that
you're
looking
for
the
downside
is
from
a
security
view.
Anytime,
someone
restarts
the
vault
server
on
the
kubernetes
cluster.
They
can
go
in
and
read
the
the
secrets.
So
there
are
some
concerns
to
that.
You
may
not
want
to
do
it
for
production,
you
might
just
do
it
for
development
environments
or
you
might
just
decide.
You
know
your
your
security
posture
allows
you
to
do
that
right.
C
A
Kind
of
depends:
do
you
find?
Do
you
find
that
you
know
you
said
talking
about
production
and
like
in
that
means
that
there's
other
other
environments?
Do
you
find
that
organizations
you
just
use
one
vault
system
for
the
other
environment
so
do
they
have
individual
vault
installations
or
can
so?
I
guess
my
question
is:
like:
can
vault
be
multi-tenant
in
a
way
where
it's
like,
hey,
like
you
know,
handle
many
environments,
or
do
you
just
see
people
just
installing
one
for
each
environment.
C
So
it
depends
on
the
open
source
or
enterprise
version,
so
the
open
source
version
you
most
of
the
time.
I
see
folks
deploying
separate
vault
clusters,
one
for
development
production.
I
still
like
that
model.
I
mean
yes,
you
know,
there's
a
it.
It's
it's
kind
of
dependent,
there's
a
cost
right
to
running
multiple
development,
environments
and
vault.
But
if
someone
just
manages
to
compromise
key,
it's
reducing
your
blast
radius
right.
If
someone
compromises
the
secrets
or
keys
in
development
they're
not
going
to
affect
production,
you
can
still
evolve
them.
A
Gotcha
gotcha
and
there's
actually
a
couple
really
good
questions
coming
down.
So
so
I'm
not
actually
gonna.
What
I'm
gonna
do
is
I'm
gonna
kind
of
sanitize
this
question
a
little
bit
or
ask
it
in
two
parts?
So
so,
usually
you
talk
about
vault
with
secret
management
and
managing
secrets
for
for
kubernetes.
C
No,
it
doesn't,
it
is
not
a
replacement
for
config
maps,
you
can
you
can
do
it.
There
is
a
feature.
So
the
basis
of
the
kubernetes
integration
for
vault
is
is
a
neat
very
little
for
some
reason,
not
well
as
well
known
feature
called
fault
agent
and
vault
agent
is
almost
like
a
templating
tool,
so
you
could
use
vault
agent
to
template
out
configuration
and
then
somehow
synchronize
that
to
a
configuration
config
map,
but
that
would
have
to
be
outside
of
of
an
existing
integration
right.
It's
not.
C
So
that's
why
you
would
prioritize
vault
agent.
Now
the
exception
is
csi
driver,
and
that
was
what
I
was
mentioning
before.
The
trade-off
to
csi
driver
is
trip.
The
csi
driver
does
write
it
to
a
kubernetes
secret,
which
means
that
you
can
see
the
password
and
username
in
plain
text.
So
the
result
is
that
it
is
if,
depending
on
how
you
run
the
vault
integration
on
kubernetes,
it
is
a
direct
replacement
for
for
kubernetes
secrets
other
times
it's
not
it's
plugging
into
the
api,
for
it.
A
So
it's
so
I
guess
it
sounds
like
it
depends
right
in
terms
with
respect
to
secrets
another.
The
other
question
is
this
really
really
great
question
I'd
like
to
hear
your
thoughts
about
it
is,
if
someone's
on
a
public
cloud,
for
instance,
for
example
aws.
Why
would
you
use
something
like
vault
versus
aws,
secret
manager,.
C
Yeah,
I
get
this
question
a
lot.
You
know-
and
this
is
the
this
is
where
you
have
to
make
this
decision
from
a
level
of
effort,
point
of
view
right,
aws
secrets
manager
works
if
you're
using
aws
right.
If
you
are
using
amazon,
something
like
amazon
ecs,
you
know
you
you
get
it
it
easily
integrates
with
secrets
manager.
You
can
store
secrets
there,
but
the
downside
is
that
secrets
manager
doesn't
really
rotate
secrets.
For
example,
it's
not
going
to
rotate
and
handle
the
issuance
of
access
keys
or
sds
tokens.
C
That's
a
separate
service
right
in
vault,
a
lot
of
people
favor
vault
over
the
cloud
provider's
native
secret
manager,
because
it
works
for
a
lot
of
different
platforms
right.
So
you
can
do
it
with
databases
whether
it
be
on-prem
public
cloud.
Otherwise
you
could
do
it
across
different
public
clouds.
You
can
use
it
to
manage
from
azure
service
principles
to
gcp
service
account
keys
to
aws
access
keys.
A
Yeah
and
and
here
at
red
hat,
we're
all
about
the
hybrid
cloud
right
and
that
kind
of
just
fit
fits
in
that
whole
aspect
of
just
like
hybrid
cloud
and
not
being
kind
of
tied
down
using
a
platform
to
kind
of
move.
Your
workloads-
and
you
know
that's
and
also
you
know,
as
you
alluded
to,
and
I
kind
of
said
before,
there's
a
management
system
so,
like
you
have
to
think
about
rotation
as
well.
C
Yeah-
and
I
did
notice
in
the
chat
cole
pointed
out
that
it
can
be
used
for
more
than
secrets,
management
and
that's
true.
You
can
use
it
also
to
encrypt
and
decrypt
data,
for
example,
data
and
transit
and
data
at
rest
too.
So
there's
a
lot
of
things
default
that
you
can
use
some
people.
Don't
it's
not
that
not
just
a
lot
of
folks.
Don't
just
use
it
for
storing
secrets,
although
that
is
something
it
does
help
with
yeah.
C
All
right,
so
I'm
not
going
to
run
this
command
because
it
will
show
my
token
vault
is
secured
by
a
token.
So
now
that
we've
unsealed
vault,
we
should
now
be
able
to
store
secrets
and
set
up
vault
right.
I
think
that's
the
natural
next
step,
so
what
I'll
do
is
actually
start
setting
up
vault
by
cli.
I
just
paste
this
command.
I
will
not
run
it.
C
This
is
going
into
the
vault
server
and
what
I'm
going
to
do
is
this
open
up
a
shell
so
that
I
can
start
configuring
vault
some
of
the
vault
components
that
we'll
need.
I
won't
go
through
every
vault
component,
but
I'll
show
the
two
main
ones
that
you're
going
to
need
for
kubernetes.
The
root
token.
Is
your
access
key?
It's
like
your
password
to
get
into
vault.
So
thus
I
will
not
show
it.
A
A
C
Right
so
I'm
in
the
vault
server
I
can
conf
there's
something
important
to
recognize
about.
Vault
vault
has
two
main
plug-ins
right.
So
if
you're
familiar
with,
let's
say,
terraform
terraform
has
something
like
providers.
The
idea
is
that
terraform
itself
is
a
server
and
then
there's
a
client.
The
client
has
all
the
logic,
so
the
providers
are
the
ones
that
capture
everything
that
you're
going
to
need
to
do
with
the
target
api.
C
Similarly,
with
vault
vault
has
a
plug-in
ecosystem.
There's
the
vault
server,
so
vaults
can
store
things.
It
can
rotate
the
secrets,
but
it
doesn't
know
how
to
rotate.
Let's
say
a
database
secret
right.
Vault
in
itself
can
just
give
the
function,
but
it
can't
do
anything
right.
So
every
bit
of
logic
that
you
need
to
rotate
the
secret
to
manage
it
to
store
it
is
captured
or
built
into
a
plug-in,
and
so
there's
two
types
of
plug-ins
for
vault
authentication
methods
and
secrets,
managers
we're
going
to
first
configure
an
authentication
method.
C
An
authentication
method
is
exactly
what
it
sounds
like
it's
a
way
for
you
to
authenticate
to
vault
right.
A
token
is
not
a
great
form
of
authentication
sharing
the
sharing
the
tokens.
You
know
it's
just
not
very
convenient
for
anybody.
If
you
have
lots
of
different
people
like
hundreds
of
people
using
vault,
you
have
hundreds
of
applications
using
vault,
you
don't
want
to
be
distributing
tokens
left
and
right.
C
So
vault
plugins
have
this
layer
of
abstraction
called
an
authentication
method
that
handles
authentication
of
some
identity
to
vault,
and
that
will
allow
that
identity
to
read
secrets
right,
so
that
sequence
is
called
an
authentication
method.
Today's
authentication
method
uses
the
kubernetes
authentication
method
which
uses
the
service
account
json
web
tokens.
A
C
Exactly
so
first
thing:
you're
going
to
do
is
enable
the
auth
method.
Everything
you
do
if
you
enable
an
authentication
method,
is
vault
auth
enable
something
so
in
this
case
I'm
authenti
I'm
enabling
an
authentication
method
at
kubernetes
and
then
what
I'll
do
is.
I
will
actually
copy
this
because
it's
a
very
long
command,
but
I
will
create
the
config
for
the
auth
method.
Oh
geez,
all
right
we'll
go
well.
C
C
Yay
excellent,
okay,
so
first
thing
is
that
I
need
to
get
the
service
account
token.
You
can
do
this
out.
You
can
do
this
outside
of
vault.
You
could
use
kubernetes
right
in
the
case
of
kubernetes.
You
would
have
to
find
the
right
service
account,
that's
attached
to
vault
and
then
retrieve
the
token.
This
is
just
an
easier
way
to
retrieve
the
direct
service
account
token
that
vault
server
is
using.
C
You
also
need
the
kubernetes
host
and
you
also
need
the
ca,
the
certificate,
the
certificate
authority
here.
So
all
of
these
things
need
to
be
added
to
the
kubernetes
to
this
kubernetes
config,
in
order
for
something,
in
this
case,
vault
to
authenticate
from
kubernetes
to
the
vault
server,
so
some
service
account
must
authenticate.
C
C
A
Yeah,
are
they
a
question?
There
was
a
question
about
vault,
rotate
secrets
only
database
aws
secrets.
What
if
I
need
to
rotate
a
token,
it's
a
good
question.
What
if
I
need
to
rotate
a
token
I
guess
which
specific
token,
but
I
guess
yeah,
since
it's
just
a
generic
management
system.
I
guess
you
can
rotate
tokens.
I
guess
there
would
be
need
to
be
a
plug-in
for
that.
C
So
that's
a
yes,
so
it
would
need
to
have
a
plug-in,
so
it
depends
on
the
token
it
there
is
a
it's
called
the
job.
One
is
called
the
identity
secrets
engine.
So
if
you
have
dots,
then
it
would
be
the
identity,
identity
secrets
engine
for
other
tokens,
like
you
could
say,
maybe
like
console
tokens
there
has
to
be.
There
is
a
plug-in
for
that.
So
there
must
be
a
plug-in
in
existence
in
order
for
vault
to
rotate
the
token.
B
A
C
This
is
welcome
to
all
so
we
started
we
configured
the
authentication
method,
so
that
way,
any
a
service
account
in
kubernetes
that
we
say
is
okay,
like
we
have
to
tell
vault
this
kubernetes
service
account
is
okay
to
authenticate
to
me.
So
as
long
as
we
allow
as
long
as
we
configure
that
in
vault,
then
we
don't
have
every
surface
account
and
kubernetes
authenticating
to
it
right.
So
we
have
the
authentication
method
configured.
The
next
thing
we're
going
to
do
is
configure
a
secret.
A
C
I
will
be
very
careful
on
this,
but
I
can't
guarantee
that
you
will
that
I
won't
accidentally
print
this
out.
So
vault
has
a
second
type
of
plugin
called
a
secret
engine.
The
secrets
engine
holds
the
logic
for
the
renewal
and
revocation
of
certain
credentials,
someone
else
usually
either
hashcore
developer
or
the
community
will
have
built
this
code
to
handle
the
renewal
of
a
secret
or
revocation
right,
so
they
delete
the
secret
or
they
create
a
new.
B
C
C
C
C
C
A
B
C
All
right,
so
the
next
thing
we're
going
to
do
is
that
we've
enabled
the
secrets
at
expense
static.
So
vault
works
on
api
paths,
so
what
you're
going
to
do
is
enable
them
at
certain
api
paths.
In
this
case
I
have
said
I
have
a
key
value
store
at
expense
static
and
what
I'll
do
is.
I
will
store
a
my
sequel
database.
Login
password
at
expense,
static,
slash,
mysql,
so
that's
the
key
and
the
value
you'll
notice
they
created
time.
C
So
I've
created
it
and
now
I'll
get
the
secret
yeah
we're
we're
here
here
we
are
all
right,
so
you'll
notice.
Now
I'm
not
just
saying
that
I
got
I
stored
the
secret.
I
have
the
secret
store,
so
you'll
notice
that
there's
the
database
login
password
so
anytime,
someone
needs
to
get
it.
They
go
to
this
path,
expense,
static,
mysql,
the
other
thing
that
you
want
to
do
when
you
start
configuring.
Something
like
this
is
you
want
to
configure
a
policy,
as
I
mentioned
before,
you
don't
want
everybody
accessing
every
secret
right.
C
You
want
some
kind
of
access
control
to
make
sure
that
no
one
is
going
to
go
and
retrieve
secrets
that
they're
not
supposed
to
it's
like
kubernetes
are
back.
So
there
is
an
independent
acl
system
in
vault
that
works
similarly
to
kubernetes
rbac
and
it
uses
effectively
api
authorization
and
it
checks
for
whether
or
not
someone
has
the
policy
to
let's
say:
read:
update,
create
or
delete
a
secret
or
a
secret
path.
C
C
I
can
only
access
this
database
password,
for
example,
okay
and
finally,
the
last
thing
that
we're
going
to
do,
because
what
we're
going
to
do
is
we
need
our
we're
going
to
create
a
database
on
kubernetes
gasp.
We
have
this
static
secret,
we're
going
to
use
the
root
password
to
configure
to
create
the
database
on
kubernetes.
C
So
what
I'll
do
is,
I
will
do
a
very,
very,
very
large
command,
and
what
this
does
is
bind
a
service
account
the
expense
database
mysql.
This
is
the
service
account.
My
database
will
use
in
kubernetes.
It
binds
the
name
space
so
in
this
case
expenses,
and
it
adds
it
and
attaches
it
to
the
policies.
So,
if
you're
familiar
with
most
of
the
cloud
providers,
you're
attaching
the
policy
to
an
identity.
A
A
C
Yeah,
that's
correct,
so
the
authentication
flow
for
kubernetes
for
kubernetes
is
that
once
a
service
account
authenticates
vault
issues
a
token,
just
like
a
token,
the
root
token
that
I
accidentally
printed
out,
but
the
the
root
token,
not
the
root
token.
The
vault
token
is
there
and
it
gives
a
certain
period
there's
a
certain
period
of
time
in
which
that
vault
token
is
valid
or
or
available.
So
it
leases.
C
You
can
say,
vault
leases
that
token
out
to
this
identity,
the
expense
dbmy
sql
service
account
for
that
period
of
time
you
have
to
re,
you
have
to
have
the
service
count
re-authenticate.
So
if
the
service
account
isn't
using
that
token
right,
it's
not
retrieving
any
any
kind
of
you
know
service
any
kind
of
passwords
or
credentials.
C
Then
it
just
sort
of
expires,
and
then
you
have
to
re-authenticate
again
right,
but
that's
usually
handled
on
the
side
of
the
the
vault
client
in
kubernetes.
For
the
most
part,
you
know
it
kind
of
just
self.
Does
this
it's
very
much
automated,
but
what
you'll
see
as
a
result
is
that
if
someone
gets
the
vault
token
like
they
exact
into
a
pod-
and
they
got
this
vault
token
from
the
the
service
account,
for
example,
it
would
expire
within
the
hour.
A
A
Yeah
yeah,
so
this
yeah,
exactly
and
like
you
know,
you
know
in
get
ops,
everything
is
about
immutability,
right
and
so
like
this
is
like
kind
of
like
where
the
contention
is.
I
think
this
is
also
where
you
kind
of
you
know.
I've
talked
to
a
lot
of
people
and
actually
one
of
them.
It's
christian
post.
I
don't
know
if
you
know
him
from
solo.
It's
you
know
we
we
were
talking
and
it's
like.
A
A
And
I
always
say
that
if,
if
you
are
it's
the
point
of
demarcation
right,
like
you're,
not
storing
pod
definitions
in
a
git
repo,
you're
you're,
storing
a
deployment
right,
it's
like
you're,
not
actually
storing
every
little
single
p
piece
right
so
like
it
as
long
as
you're,
storing
some
reference
that
gives
you
the
functionality
that
you
want.
I
think
you're
like
at
the
right
path,
right
at
least
you're,
going
towards
that
path
of
of
you
know
that
nirvana
of
get
ops
right
so.
C
Yeah
yeah,
and
the
way
I
think
about
it
to
myself
is
that
the
the
idea
behind
git
ops
was
to
modularize
a
certain
automation,
piece
pieces
of
automation
in
your
infrastructure
system
into
different
into
different
controllers.
Right,
like
the
idea
is
that
you
want
to
separate
this.
Should
you
for
something
like
a
secret
that
sensitive
information?
C
Should
you
be
managing
it
with
the
same
controllers
that
you're
using
for
deploying
an
application
for
something
else?
And
maybe
the
answer
is
yes
and
and
most
likely,
the
answer
is
no.
You
know
it's
managing
a
different
kind
of
life
cycle
of
that
particular
infrastructure
secrets,
our
infrastructure
effectively.
So
it's
managing
a
different
part
of
the
infrastructure,
in
which
case,
perhaps
from
a
separation
of
concerns,
view
it's
not
really
breaking
get-ups.
It's
perhaps
just
a
different
controller.
A
Yeah
exactly
yeah,
yeah,
you're
or
you're
delegating
that
right,
you're,
delegating
that
you
know
we.
I
have
the
same
conversation
because
we're
at
red
hat
right,
we're
all
about
operators
right
and-
and
you
know,
operators
has
a
lot
of
automation
in
it
right,
and
so
it's
like
okay,
well,
where's!
You
know
it's
like!
Well,
really!
You
want
as
long
as
you
get
a
function
as
long
as
your
cluster
is
functionally
the
same
as
it
was
before
right.
A
This
is
a
disaster
recovery,
but
does
it
really
matter
if
it's
a
hundred
percent
that
inc
inside
your
gate,
repo
right
we're
talking
ab
alexis
actually
from
from
we've
works,
said
that,
like
the
idea
is
to
have
a
functionally
that
the
cluster
is
functionally
the
same,
not
necessarily
exactly
the
same
right,
and
so
as
long
as
like
this
database
is
back
up
and
running.
Why
do
you
care
if
the
password
is
the
same
or
not?
So
it's.
A
C
All
right,
so
what
I
did
behind
it
just
so
that
it
takes
it
gets
a
little
bit
of
time
to
create.
I
created
a
mysql
database
on
kubernetes
and
the
reason
why
I
wanted
to
show
this
was
at
least
you
got
the
example
of
a
static
secret
right.
This
is
something
that
no
one's
rotating
it
I
mean.
I
guess
I
could
just
keep
it
in
in
vault
and
never
rotate
it,
which
you
could
do
that's
static
secrets
right.
So
not
every
secret
has
to
be
rotated.
C
As
you
pointed
out
christian,
you
know
you
may
do
you
really
care
if
it
is
or
isn't,
but
from
a
security
perspective.
You'll
eventually
have
to
rotate
it.
In
this
case,
what
I've
done
is
create
the
expense
database
and
it's
retrieved
the
base.
It's
what
it's
done
is
retrieved
the
database
pass
root
password
from
vault
and
the
kind
of
way
you
can
show.
Let
me
see
if
I
can
show
this
a
little
bit
easier,
but
you'll
notice,
two
pods
one
pod
is
the
database
and
the
other
is
vault
agent.
C
So
let
me
see
if
I
can
get
the
logs
from
vault
agent,
the
asian
injector
created
this
lovely
little
snippet
patched
it
in
and
what
it
what
it
allows
this
to
do
is
to
create
a
sidecar
container
for
vault,
and
this
vault
agent
just
runs
and
renders
out
some
information
about
the
the
the
database
password.
So
what
vault
agent
will
do-
and
this
is
a
bit
of
the
workflow
that
I
do
want
to
show-
and
I
don't
know
if
we
can
do
that.
Oh
we
won't.
We
will
do
that.
C
But
what
happens
is
that
the
sidecar
requests
the
database
password
from
vault
and
then
vault
will
go
to
the
database
and
say
hey
database.
Can
you
create
me
a
new
username
and
password,
and
then
it
will
come
back
and
say
here
you
go,
that's
a
more
complicated
flow
and
I'll
show
that
one
next.
But
in
this
case
it's
really
just
saying
the
database
comes
up
and
says
hi
vault.
C
I
need
a
static
password
so
that
I
can
start
myself
up,
and
so
then
it
will
start
vault
agent,
while
agent
writes
it
to
a
file
and
then
you
can
use
that
file
for
the
application.
In
this
case
my
sql,
it's
a
lot
of
a
back
and
forth
workflow,
but
it's
a
lot
easier
to
see
it
actually
in
the
application
itself
and
not
the
database.
A
This
question
right
that
you
can't
really
save
config
maps,
but
there
are
there.
There
may
be
plug-ins
upstream.
That
does
that.
Do
that.
But
my
question
is:
is
you
talk
a
lot
about
a
site
cars?
Is
this
kind
of
like
like
something
like
service
mesh
where
there's
a
side
car
in
every
container
or
only
on
the
ones
that
need
it.
C
C
C
C
The
other
important
sets
of
annotations,
which
thank
you
for
reminding
me
to
show
the
annotations,
the
other
important
annotations
that
you
need
have
to
do
with
vault
config.
So
remember
we
created
that
role.
That
said,
anyone
who's,
expensed
db
mysql
can
connect
to
it.
Well,
this
is
the
role
expense
tv,
my
sequel.
You
also
need
to
set
the
service
account
name
to
a
match,
the
one
that
you
bound
to
vaults,
authentication
method.
C
So
remember
previously,
we
said
if
your
service
account
is
expense
dbmysql
and
your
namespace
expenses,
you
can
authenticate
to
kubernetes
and
sorry
authenticate
from
kubernetes
to
vault
and
retrieve
the
static
database
password.
You
also
need
to
specify
a
couple
annotations
about
where
you're
getting
the
secret.
So
in
this
case
I
am
getting
the
secret
from
the
path
expense,
static
data,
my
sequel,
and
this
is
where
vault
agent
and
configuration
kind
of
mixes
a
bit.
So
someone
asked
the
question
about
whether
or
not
this
replaced
openshift
config
maps
and
secrets.
C
C
In
this
case,
all
I'm
doing
is
exporting
the
my
sql
root
password
and
using
some
templating
commands
to
retrieve
it
from
vault.
So
while
this
is
a
little
confusing,
the
idea
is
that
you
can
template
configuration
whether
it
be
for
application
or
for
some
other
target
that
needs
to
use
this
password,
and
then
you
can
use
that
to
capture
whatever
config.
You
need.
A
You
know,
I'm
glad
you
showed
these
annotations,
because
it
kind
of
makes
me
think
of
two
things
is
one:
that's
like
if
you're
you
know
this,
since
this
is
the
deployment
you're
actually
storing
this
and
get,
and
so
you
know
this
is
the
important
part
to
store
and
get
right
like
how
this
application
retrieves
the
secret
is
it's
part
of
get
ops
right.
It's
it's
it'll
function.
You
know
as
as
long
as
vault's
configured
correctly.
You
know
I
when
I
apply
this,
you
know
if
the
access
is
configured
correctly.
A
When
I
apply
this
it'll
have
access
to
to
that
secret,
right
and
and
two
I
think
so
you
can
technically.
Let's
just
say
you
know,
instead
of
exporting
this,
you
can
technically
have
written
this
to
a
file
right,
because
this
is
just
a
go
like
temp
go
template
right,
so
I
could
and
that's
technically
you
know
your
config
map
settings.
Even
though
it's
not
directly
a
config
map
right,
you
can
write
out
a
configuration
if
you
want
so
this.
This
is
actually
really
cool.
C
B
C
C
So
it's
writing
to
a
file
that
says
export
my
sql
root
password,
and
so
it
will
source
it
and
then
run
the
entry
point
for
what
you're
mentioning
is
actually
what
we're
going
to
show
I'll
shoot
this
one,
but
we
won't
deploy
it
because
of
the
sake
of
time,
but
similarly
right
what
you
mentioned
before
was
that
you
could
write
a
configuration.
You
could
write
any
kind
of
configuration
you
need
like
a
confect
map,
you'll
notice.
This
is
a
little
bit.
This
is
a
spring
application
properties
file.
It's
got
zipkin
enabled
you
know.
C
You've
got
a
data
source
that
connects
to
expense
dbmy
sql
you've
got
the
port.
The
one
thing
that
I've
done
is
render
out
the
data
user,
the
database
username
and
password
for
the
application
to
use
to
connect
to
my
sql
database,
the
mysql
database.
So
it
writes
it
out
to
application
properties,
any
kind
of
config
file
that
you
want.
You
can
write
it
to
and
the
application
can
pick
up
the
information
it
needs
from
that
configuration
file.
A
So
we
got
a
question
here.
This
is
actually
pretty
cool
when
a
pat-
and
this
was
actually
a
question
I
had
so
when
a
password
are
updated
or
rotated
or
whatever.
When
your
secrets
are
rotated,
is
you
know,
I
guess
the
question
is?
Can
the
deployment
be
triggered
automatically,
but
I
guess
the
question
is:
is
it
triggered
automatically?
If
not
you
know,
can
we
treat
you
know?
Can
we
do
it?
Yeah.
B
C
B
C
Platform,
your
application
has
to
support
kind,
some
kind
of
hot
reload
right
in
that
it
once
you
write
out
the
file,
it
has
to
be
able
to
detect
that
the
file
has
changed
and
then
reload
itself,
which
not
to
some
frameworks,
will
do
it
and
some
frameworks
yeah
right.
So
there's
not
really,
unfortunately,
there's
not
really
a
way
to
trigger
the
application
to
restart
itself.
After
you
know,
the
secret
has
been
rotated,
and
now
it's
been
rewritten
vault
agent,
so
the
sidecar
will
detect
and
identify
changes
to
the
secret.
C
So
if
vault
says
you
have
to
rotate
it
now,
vault
agent
will
detect
that
and
retrieve
and
automatically
create
a
new
config
render
a
new
config
file
for
you.
So
vault
agent
will
automatically
do
it,
but
vault
agent
isn't
able
to
you
know,
poke,
let's
poke
the
application
and
say
hey.
You
need
to
restart,
because
I
have
a
new
config
file
for
you.
You
could
write
it.
A
B
A
A
Just
because
of
the
just
because
of
the
fact
that
it's
just
openshift
does
it
doesn't
have
that
openshift.
You
can
encrypt
your
secrets
at
rest
or
let
me
rephrase
that
you
could
encrypt
fcd
at
rest
with
openshift,
but
like
a
management
system,
openshift
doesn't
have
any,
which
is
why
something
like
vault
is,
is
important
to
have,
especially
if
you
you
know,
you
don't
want
to
do
this
all
this
stuff
manually
right
like
if
you
don't
want
to
you.
B
A
The
the
biggest
thing
right,
so
some
people
ask
me
you
know
how
do
how
do
I
treat
secrets
and
get
ups?
I
say:
well,
it's
I,
like,
I
always
say,
crawl
walk
run
right.
The
the
immediate
answer
is
sealed
secrets,
because
the
the
the
the
point
of
entry
is
so
low
right.
It's
it's
not
so
steep,
but
you'll
find
as
you
grow.
It's
it's
really
hard
to
manage
right.
A
It
doesn't
scale
well
when
you're
at
a
at
a
certain
size,
you'll
need
like
a
management
system,
and
you
know
luckily,
red
hat
has
has
partners
like
hashicorp
that
you
can
actually
get
support
now
on
both
ends
right.
So
you
have
you
have
the
support
for
your
container
platform
from
red
hat.
You
have
your
secret
management
support
from
hashicorp.
So
if
like
support
something
if
you're
running
a
large
enterprise,
something
that's
really
important,
you
have
that
end
to
end.
So
so
hopefully
that
answers
the
question
there.
C
If
you
haven't
noticed,
vault's
workflow
is
quite
complex,
you
know
it's
not
great
when
you're
first
starting
and
you
need
to
get
the
secret
and
you
need
to
just
get
it
running.
You
have
to
take
the
time
to
and
go
in
and
secure
it.
So
it's
worth
it,
but
it
does
have
some
complexities
and
you
have
to
figure
that
out.
B
C
You
might
not
have
time
to
do
that,
so
all
right.
So,
for
the
sake
of
time,
I'm
going
to
expedite
the
next
configuration
a
bit,
but
we
configured
a
static
database
root
password.
So
now
what
I'm
going
to
do
is
configure
dynamic,
dynamic
credentials,
so
dynamic
credentials
work
differently
than
storing
it
in
key
value.
Key
value
is
here's
a
key.
C
Here's
a
value
you,
the
operator
or
developer,
are
you're
going
to
be
the
one
to
figure
out
if
you
rotate
it
in
the
case
of
certain
secrets,
engines,
certain
secrets,
engines
will
handle
the
rotation
for
you.
So
what
I
mentioned
before
was
that
you
know
you
could
rotate
any
token
you
wanted
if
it
was
supported
by
a
plugin
right.
C
C
So
the
thing
that
I've
done
is
you'll
see
very
similar
workflow.
I
enabled
the
secrets
engine
at
the
expense
database,
mysql
path
for
a
database
secrets
engine
and
the
database
secrets
engine
has
a
couple
different,
configs
you'll
need
you
have
to
tell
it
which
plugin
you're
going
to
use.
Yes,
there
are
multiple
plugins
but
they're
all
bundled
under
the
database
type.
So
there's
a
plugin
for
mysql
postgresql.
There's
lots
of
other
databases
that
you
can
use,
but
you
do
have
to
specify
the
name
of
it
and
most
of
them
ask
you
for
a
connection.
C
Url,
so
vault
needs
a
way
to
access
the
database,
because
it's
using
a
database
creation
statement
to
create
the
user.
So
you
need
connection
to
the
database.
You
also
need
a
username
and
password
with
the
ability
to
create
and
renew
users
revoke
users,
and
you
know,
depending
on
the
kind
of
workflow
you
want.
So
this
username
must
be
an
administrative,
username
and
administrator
password.
C
Vault
can
act
rotate
this
for
you
fun
fact.
We
will
not
do
that
today,
but
if
you
pass
it
in
vault
can
handle
this
internal
rotation
for
you.
If
you
tell
it
to
rotate
the
root
password,
so
you
can
tell
it
to
do
that,
there's
also
the
roles
I'm
only
allowing
the
expense
roll,
so
this
is
tied
to
any
secrets
related
to
the
expense
application
that
I'll
deploy
and
you'll
notice.
Once
again
here
we
are
root
the
root
username
and
the
root
password,
but.
A
C
B
C
There
we
are
so
you'll
notice,
there's
something
called
a
creation
statement
there,
it's
kind
of
truncated
by
the
terminal,
but
the
creation
statement
is
what
vault
will
use
to
create
a
new
user,
so
you'll
have
to
configure
something
called
a
role
and
that
rule
will
tell
tell
the
database
whether
or
not
it
should
create
the
user
revoke
the
user
renew
credentials.
You
know
everything
there.
C
So
the
creation
statement
is
a
sql
statement,
as
you
can
recognize
so
just
be
sure
to
get
the
right
sql
statement
and
once
again
we
set
our
time
to
live
for
this,
the
database
username
and
password
to
one
hour
with
a
maximum
of
24
hours.
So
it
gives
a
little
leniency
and
then
we
write
again
once
again
a
policy.
The
policy
restricts
the
expense.
C
From
this
path,
which
contains
the
database
username
and
password
not
the
root,
this
is
the
dynamic
one.
So
vault
will
issue
it
for
me,
and
so
then,
after
that
you'll
scroll
up,
oh
no
well
anyway,
I'll
paste
this.
So
that
way
you
can
see
the
command,
but
here
we
go
and
once
again
we
bind
the
service
account.
So
this
will
only
this
will
say
only
expense
service
account
in
the
expenses
namespace.
Can
access
whatever
is
defined
in
this
policy?
So
remember,
the
policy
was
expense
database
by
sql
credits.
C
C
Yeah
and
it's
a
dynamic
secret,
so
it
is
not
actually
how
do
I
put
this?
It's
not
the
root,
it's
not
the
root
database,
username
or
password
vault
will
actually
go
to
the
database
to
the
mysql
database
and
say:
hey.
Can
you
give
me
a
new
username
and
password,
and
what
you'll
see
is
that
it
comes
out
with
this
unique
username
and
password?
I
could
run
it
again
and
it's
a
different
username.
C
Yeah
and
so
what
vault,
what
vault
is
doing?
Is
it's
saying?
Okay,
anytime,
you
read
from
this
api
endpoint
I'll
issue,
you
a
new
username
and
password
I'll
lease
it
to
you
for
a
certain
period
of
time,
which
is
an
hour.
You
can
opt
to
renew
it,
but
if
you
don't
renew
it
I'll
just
revoke
these
credentials
from
the
database
and
you
can't
use
them
to
log
in
anymore.
A
C
Yep
exactly
and
if
you
wanted
to
do
it
again,
if
you
wanted,
if
you
still
needed
access,
you
have
to
renew
renew
yourself
right.
You
have
to
re-authenticate
and
renew
your
access,
so
it's
a
very
useful
way
to
limit
the
time
to
live
or
with
the
life
cycle
of
a
given
secret
and
why
this
is
important
to
understand
each
pod
in
kubernetes
gets
its
own
username
and
password.
So
if
that,
if
that
pod,
you
know
somehow
restarts
stops,
you
know,
gets
redeployed,
vault
issues,
a
new
username
and
password.
A
C
To
I'll
move
on,
you
can
deploy
this
with
vault
agent,
which
is
what
I
originally
showed
so
agent
sai
car
was
deployed
injected
attached
to
the
to
the
deployment,
and
then
you
saw
that
agent
running
as
a
sidecar
there's
a
second
way
that
I
mentioned
that
you
can
do
this
called
csi
driver,
yeah
csi
driver,
it's
a
project
that
uses
the
container
storage
interface,
but
what
it
was.
What
it
is
is
an
interface
specific
to
secrets
to
storing
secrets.
A
C
Instead,
all
you
have
to
do
is
deploy
a
crd
as
well
as
two
sets
of
controllers.
One
is
the
csi
secret
store
driver,
which
is
what
I'm
updating
right
now
and
then
the
as
well
as
the
vault
integration,
the
vault
driver,
so
the
vault
provider,
for
it.
So
there's
two
pieces
to
this,
which
I'll
show
get
pods.
C
B
B
A
Time
you
see
the
word
privileged
in
your
sec,
like
that's
like
a
big
warning
right
like
make
sure
you
know
what
you're
doing,
because
privilege
there's
difference
between
like
a
pod
running
as
brute
and
pot
as
well
as
privileged
and
like
you
should
avoid
privileged,
unless
you
absolutely
have
to
right.
So
like
things
for
like
storage,
you
kind
of
have
to
write
because
you're
like
actually
accessing
the
the
the
underlying
hardware
of
of
the
of
the
of
the
node.
That's
currently
running
on
so.
C
Yeah
and
that's
where
you'll
it'll
trip
you
up,
you
know
you
don't
really
want
to
it's
not
ideal.
We
could
all
acknowledge
that
it's
not
ideal
but
yeah
when
you
run
it
as
privileged,
nothing
will
get
nothing
will
get
created
until
you
give
that
access,
which
I
might
actually
have
to
uninstall
this.
Unfortunately,
in
order
for
it
to
run
so,
if
anybody
has
any
secrets
as
to
how
to
get
this
to
maybe
I
should
just
deploy,
remove.
C
We'll
rerun
the
helm,
so
it's
a
little
bit
faster
because
otherwise
it
will
sit
here
and
wait
until
it
has
the
opportunity
make
csi
okay.
So
let
me
just
yes:
I
deploy
so
deploy
the
driver,
and
then
you
have
to
deploy
the
vault
provider
both
have
to
happen.
Both
have
to
have
elevated
access.
Your
application
even
needs
to
have
access
as
well,
but
I'll
show
you
why
the
csi
is
a
little
bit
different.
C
C
So
what
the
secret
provider
class
does
is
that
it
reaches
it
uses
the
secret
store
driver
as
well
as
the
vault
provider.
It
reaches
out
to
vault
and
retrieves
specific
secrets.
So
remember
in
the
case
of
the
annotation,
I
said:
let's
go
out
and
get
the
expense
database
mysql,
creds
expense.
These
are
the
ones
that
are
dynamically
issued
by
vault.
It's
the
funky
username
with
the
funky
password
and
so
similar
kind
of
configuration.
C
A
B
C
A
Yeah
because
yeah,
it's
not
still
secret
so,
like
you
know
again
the
secret
in
kubernetes,
it
just
describes
what
it
is,
not
what
it's
doing
right
like
it's.
It
isn't
hiding
anything
from
you.
So
if
you're,
if
your
hat,
if
you
have
something
involved-
and
it's
you
know
it's
sealed
in
vaults
but
you're,
injecting
that
into
a
secret
well,
then
that's
in
clear
text.
You
just
have
to
just
keep
that
in
mind
right.
You
have
to
keep
that
in
mind
when
you're,
using
the
csi
driver.
B
A
C
If
you
are,
if
you're
running
a
lot
of
applications-
and
you
don't
want
side
cars,
then
this
could
work,
but
there
are
some
concerns
right.
You
do
have
to
have
elevated
access
to
the
application.
You
have
to
have
elevated
access
for
the
provider
and
and
the
driver.
It
does
write
it
as
a
kubernetes
secret.
So
let's
hope
this.
A
C
A
Yeah
and
it
may
not
be
a
big
deal
right,
so
it
always,
it
just
depends
the
the
environment
right
because
sometimes
production,
like
you
know
it's
it's
so
separated
from
development
that
knowing
that,
like
only
few
people,
can
log
into
it
anyway.
So
this
this,
it
might
work
for
you.
In
that
case,
when
not
a
lot
of
people
are
accessing
the
cluster,
so
yeah.
B
C
Yeah
so
there's
a
new
secret
that
came
up
and
that's
because
the
secrets
provider
class
is
synchronizing
the
information
from
vault
to
the
kubernetes
secret
and
well
you
can
you
get
the
username
and
password
if
you,
you
know,
bring
up
the
terminal
a
bit,
but
the
the
idea
behind
this
is
that
you
know
if
you
are
using
your
application
and
it
just
needs
to
read
the
secrets
from
it.
Well,
you
pretty
much
have
the
ability
to
do
this
out
of
the
box.
C
C
C
Now,
if
you
have
three
different
secrets
for
each
application
from
kind
of
a
risk
mitigation
view,
it's
probably
better
to
create.
You
know
a
a
service
account
for
each
secret
and
then
bind
a
policy
specific
to
that
right
so
say
you
know,
you
have
expense
a
report
and
a
database
and
they
all
use
different
kinds
of
secrets.
It's
better
to
just
bind
different
policies
to
different
service
accounts
and
then
have
them
use
different
service
accounts,
but
there's
nothing
stopping
you
from
using
one
service
account
for
all
through
the
applications.
You
just
allow
the
policy.
C
C
A
Yeah
from
a
technical
standpoint,
you
probably
can
do
a
lot
of
things,
but
you
know
you
need
to
do
that
that
risk
analysis
right.
The
risk
mitigation
have
your
you
know.
The
the
security
team
also
probably
needs
to
probably
sign
off
on
it
as
well.
So
it's
it's
always
it's
always
to
error
on
the
side
of
caution,
right,
dude,
right,
exactly.
C
Well,
that
is
all
I
had
to
show
the
example
is
in
the
repository
we'll
I'll
build
on
it
for
the
next
part,
but
hopefully
this
gives
a
a
sense
of
in
introduction
to
vault
the
couple
ways
that
you
can
use
it
on
kubernetes
the
different
patterns
that
are
offered
and
some
of
the
caveats
and
trade-offs
to
both.
It
is
a
little
complicated
when
you
first
start
out.
B
A
A
So
when
I
first
asked
wait,
you're
this
you're
on
the
side
when
I
first
asked
rosemary
to
come
on
she's
like
well,
I'm
gonna
need
actually
you
know
multiple
times,
because
you
know
it's
it's
kind
of
a
complex
situation,
so
we
we,
we
decided
just
to
do
kind
of
like
a
baseline,
vault
introduction.
This
episode
she's
actually
going
to
come
next
time
right
so
part,
two
stay
tuned
for
part
two,
where
we
actually
talk
about
specific
implementations
with
get
ops
and
specifically
with
argo
cd.
A
So
that's
gonna
be
a
fun
one.
So
hold
on
to
your
question.
Florian
come
come.
You
know
not
next
week
with
the
week
after
right
next
episode
we'll
be
on
talking
specifically
about
argo,
cd
and
vault.
So
that's
that'll,
that's
gonna,
be
that's
gonna,
be
cool.
So
thank
you.
Everyone
for
staying
on
this
one
ran
a
little
bit
long,
but
I
I
you
know
I
told
rosemary
hey.
A
You
know
you
know
we,
we
don't
have
a
hard
stop
to
take
as
long
as
as
long
as
you
need
to
to
have
some.
You
know
to
at
least
have
the
baseline
information.
I
know
a
lot
of
people
were
excited
about.
You
know
you
coming
on.
You
know,
hashicorp,
you
know
talking
about
this
with
with
github,
so
so
yeah.
So
you
can
find
me
on
twitter
right,
so
you'll
you'll
see
down
here
somewhere,
where
you
can
find
me.