HashiCorp Vault — Kubernetes Integration

1 minute read

Vault integrates deeply with Kubernetes for secrets management — from deploying Vault itself on K8s to injecting secrets into pods automatically.

What’s in This Chapter?

# Topic Description
1 Helm Chart Deployment Deploy Vault on Kubernetes with Helm
2 Kubernetes Auth Authenticate pods using service accounts
3 Agent Injector Deep Dive Advanced injection patterns
4 CSI Provider Mount secrets as Kubernetes volumes
5 External Secrets Sync Vault secrets to K8s Secrets
6 Practice Exercises 5 hands-on exercises

Integration Methods Compared

Method How It Works Best For
Agent Injector Mutating webhook injects sidecar Most Kubernetes workloads
CSI Provider Mount secrets as volume files No sidecar overhead needed
External Secrets Sync to K8s Secret objects Apps that expect K8s Secrets
Direct API App calls Vault API directly Custom logic, full control
Vault Agent sidecar Manual sidecar configuration Complex template needs

Architecture Overview

┌──────────────────────────────────────────────────┐
│                 Kubernetes Cluster                 │
│                                                    │
│  ┌──────────┐  ┌──────────┐  ┌────────────────┐  │
│  │  Vault   │  │  Agent   │  │  CSI Provider  │  │
│  │  Server  │  │ Injector │  │   DaemonSet    │  │
│  │  (HA)    │  │ Webhook  │  │                │  │
│  └─────┬────┘  └────┬─────┘  └───────┬────────┘  │
│        │             │                │            │
│        │     ┌───────▼────────────────▼──────┐    │
│        │     │        Application Pods       │    │
│        └─────│  ┌─────────┐  ┌────────────┐ │    │
│              │  │ Sidecar │  │ CSI Volume │ │    │
│              │  │ Agent   │  │ Mount      │ │    │
│              │  └─────────┘  └────────────┘ │    │
│              └───────────────────────────────┘    │
│                                                    │
│  ┌────────────────────────────────────────────┐   │
│  │         External Secrets Operator          │   │
│  │  Syncs Vault → Kubernetes Secrets          │   │
│  └────────────────────────────────────────────┘   │
└──────────────────────────────────────────────────┘

Prerequisites

  • Kubernetes cluster (1.22+)
  • Helm 3
  • kubectl configured
  • Vault CLI (for setup commands)

Chapter Flow

Start with Helm Chart Deployment to get Vault running on Kubernetes.

Next: Helm Chart Deployment

You may also enjoy