Overview of external secret providers
By default, Secrets on Kubernetes are stored in etcd as mentioned in Chapter 1, Understanding Kubernetes Secrets Management. Storing Secrets on etcd comes with certain security concerns, as mentioned in Chapter 7, Challenges and Risks in Managing Secrets. Alternative forms of secret storage can help us harden our security and also segregate the concerns that come with secret usage. We will focus on the components that make it feasible to have external secret providers.
First, let us have a look at the available external secret store providers:
- AWS Secrets Manager
- Azure Key Vault
- GCP Secret Manager
- HashiCorp Vault
- CyberArk Conjur
The way these providers offer integration with Kubernetes might differ. A very popular approach to achieving integration with a secret store provider is through the Secrets Store CSI Driver.
Secrets Store CSI Driver
The Secrets Store CSI Driver makes it feasible to integrate Kubernetes...
