Secret Store CSI Driver Tutorial | Kubernetes Secrets | AWS Secrets Manager | KodeKloud

Dive deep into the world of Kubernetes security with our comprehensive guide to Secret Store CSI Driver. Discover why this tool is essential for safeguarding sensitive information, learn how it compares to alternatives like ESO and Sealed Secrets, and master the process of setting it up for your Kubernetes cluster. With insightful demos showcasing the creation of secrets in AWS Secret Manager and the seamless integration of Secret Store CSI Driver, this video is your ultimate resource for enhancing security in your DevOps environment. Join us on this journey to strengthen your Kubernetes security posture and protect your valuable data.

⬇️Below are the topics we are going to discuss in this video:
00:00 - Introduction
00:48 - Why do we need Secret Store CSI Driver?
03:03 - What is Secret Store CSI Driver?
04:01- Secret Store CSI Driver vs ESO vs Sealed Secrets
05:25 - How does Secret Store CSI Driver works?
08:14 - Demo - Creating Secret in AWS Secret Manager
09:30 - Demo - Setting up Secret Store CSI Driver for Kubernetes Cluster
30:56 - Conclusion

Check out our learning paths at KodeKloud to get started:

#Kubernetes #DevOps #SecretStoreCSIDriver #K8sSecurity #AWS #sealedsecrets #awssecrets #DevOpsTools #CyberSecurity #CloudComputing #kodekloud

For more updates on courses and tips, follow us on:

[ChiruMegs]

Looked at many videos to understand AWS Secrets, CSI drivers and Storage Class. This is the Best tutorial on this topic I had found till date.

[nforlife]

What a great demo and some troubleshooting
My fav is Hashicorp vault!

[omega]

Excellent Excellent excellent....thanks a lot

[algomithr]

me screaming from 27:57 to 28:18 "ctrl+f rotat" 😀😀
j/k .. nice tutorial, thanks!

[rishisharath]

Thank you so much for making this, its been really helpful, also just to add to anyone wondering, if ur creating ur application in a seperate namespace make sure u create the service account in that particular namespace too and not in defualt namespace.

[HadiAl-Atally]

That was one fantastic demo, many thanks.

[mynenisr]

Very well done. So far I used ASM. so thats my fav.

[alexferreira]

Wow! No needed to restart pod to get updated secret!

[vladimirsiman]

this video is a high quality stuff, thanks a lot, great !

[darkjo]

Hello, thank you for your great video! I would like to know if it’s possible to use a CSI storage driver in my EKS cluster without configuring the OIDC provider for the cluster. Specifically, I want to rely solely on the IAM roles of the worker nodes and add the necessary permissions to retrieve secrets from Secrets Manager through those roles. I understand that this may not be the most secure option, as all pods on the worker nodes would inherit the permissions of the worker nodes.

[yashgoyal]

I have a question from a application developer perspective. So instead of getting secret values as env variables from helmcharts, we get it in a file mounted at a specific location inside a pod. So can we use that file to extract secrets to use in our application code. (JAVA using spring boot framework)

[fabrizzio_aranda]

Great information, looks like with this implementation it won't be possible to use the secrets as env variables, instead I will need to indicate my app to fetch the secrets from a file, and monitor when the secret's value changes, correct?

[subithalsubbaiah]

@kodeKloud, I'm wondering, How is it safe when the password is saved in plain text inside the pod. Anyone with read access, who can read the k8s secret can also read the pod's volume. Correct me if I'm wrong.

[sonubhagat]

Is that anyways to configure webhook so that whenever something changed to secret manager it should notify to csi

[manuvu]

I have done as it is it worked 🎉, but I have try with multiple node group in same cluster like node-dev and node-qa, with different secret manager but iam not able to access in one node, in node-dev group instance are running.. but in node-qa group instance are not running.. with same configuration ( I have cross check twice)
Check with secret store log that are not mounted, it's not able to retrieve secret from Secret manager error like "Failed to fetch secret from all regions"

[Tester-fj]

Hi you'r video looks great
can you please explain how can i use the value in the pod env section ?

Thank you

[pradippipaliya]

Is there any way to inject secret value as env variable inside the pod without creating kubernetes secrets??

[rajenderprasad]

This is great demo.. I have a question. Is there any way to create configMap instead of secret..

[pradippipaliya]

@kodeKloud, How can we use secrets from secret manager into our on-premise kubernetes cluster which is setup using kubeadm?? We want to use Secret store CSI Driver to inject secret into pod from secret manager. I have find a lot but not getting anything, please help.

[tonyc]

sealed secret is my favorite since the secret is never stored in plain text on a file system.