Injecting vault secrets into Kubernetes Pod Environment variable

Question

I'm trying to install Sonarqube in Kubernetes environment which needs PostgresSQL. I'm using an external Postgres instance and I have the credentials kv secret set in Vault. SonarQube helm chart creates an Environment variable in the container which takes the username and password for Postgres.

How can I inject the secret from my Vault to environment variable of sonarqube pod running on Kubernetes?

Creating a Kubernetes secret and using the secret in the helm chart works, but we are managing all secrets on Vault and need Vault secrets to be injected into pods.

Thanks

Answer 1

There are 2 ways to inject vault secrets into the k8s pod as ENV vars.

1) Use the vault Agent Injector

A template should be created that exports a Vault secret as an environment variable.

spec:
  template:
    metadata:
      annotations:
        # Environment variable export template
        vault.hashicorp.com/agent-inject-template-config: |
          {{ with secret "secret/data/web" -}}
            export api_key="{{ .Data.data.payments_api_key }}"
          {{- end }}

And the application container should source those files during startup.

args:
  ['sh', '-c', 'source /vault/secrets/config && <entrypoint script>']

Reference: https://www.vaultproject.io/docs/platform/k8s/injector/examples#environment-variable-example

2) Use banzaicloud bank-vault

Reference: https://banzaicloud.com/blog/inject-secrets-into-pods-vault-revisited/.

Comments:

Both methods are bypassing k8s security because secrets are not stored in etcd. In addition, pods are unaware of vault in both methods. So any one of these can be adopted without a deep comparison.

For vault-k8s and vault-helm users, I recommend the first method.