Enable Kubernetes Pods to Securely Access Secrets Stored in External Systems AWS KMS, Google Cloud KMS, or HashiCorp Vault

To enable Kubernetes pods to securely access secrets stored in external systems (such as AWS KMS, Google Cloud KMS, or HashiCorp Vault) by injecting them as Kubernetes secrets, you can use Kubernetes External Secrets (KES) alongside a Key Management Service (KMS) provider for encrypting/decrypting these secrets.

Here’s how you can set up this integration:

1. Install Kubernetes External Secrets

Kubernetes External Secrets allows Kubernetes to fetch secrets from external APIs like AWS Secrets Manager, AWS Parameter Store, and HashiCorp Vault. First, install KES in your cluster.

1. Add the Helm repository for KES:

helm repo add external-secrets https://charts.external-secrets.io helm repo update

1. Install the external-secrets Helm chart:

helm install external-secrets external-secrets/external-secrets --namespace external-secrets --create-namespace

1. This will deploy the necessary CRDs and controllers in your cluster.

2. Configure KMS for Secret Encryption/Decryption