Can i insert secrets into deployment.yml using Azure KeyVault?

Question

I have integrated Azure KeyVault using Terraform. I can ssh into the container and can view the secrets.

My questions is: Is it possible to somehow reference that secret value inside my deployment.yml file that i use for deploying my pods in the kubernetes cluster?

I am using the following deployment file. Normally I access the Kubernetes secrets using the valueFrom and then referencing the secret name and key here. How would that be possible if i want to insert the value of secret using keyvault here.

-spec:
  containers:
    - name: test-container
      image: test.azurecr.io/test-image:latest
      imagePullPolicy: Always
      ports:
        - containerPort: 8080
      env:
      - name: testSecret
        valueFrom:
          secretKeyRef:
            name: testSecret
            key: testSecretPassword

Thanks

Ken W MSFT Ken W MSFT · Accepted Answer · 2019-10-02T11:05:25

You will need a Terraform data source. Data sources allow data to be fetched or computed for use elsewhere in Terraform configuration. Use of data sources allows a Terraform configuration to make use of information defined outside of Terraform, or defined by another separate Terraform configuration.

data "azurerm_key_vault_secret" "test" {
  name         = "secret-sauce"
  key_vault_id = "${data.azurerm_key_vault.existing.id}"
}

output "secret_value" {
  value = "${data.azurerm_key_vault_secret.test.value}"
}

You can look at Key Vault FlexVolume to integrate Key Vault into K8s. Secrets, keys, and certificates in a key management system become a volume accessible to pods. Once the volume is mounted, its data is available directly in the container filesystem for your application.

I will be honest, I have not tried this solution and don't know if it will work outside of our AKS offering.

https://www.terraform.io/docs/providers/azurerm/d/key_vault_secret.html

https://blog.azureandbeyond.com/2019/01/29/terraform-azure-keyvault-secrets/

Can i insert secrets into deployment.yml using Azure KeyVault?

1 Answers