Using HashiCorp Vault to store secrets

Written by

Updated at May 5, 2025

Required paid resources
Get your cloud ready
Install HashiCorp Vault
Log in to HashiCorp Vault
Create a secret
Configure the Kubernetes authentication method
Install the SCI driver for the secret storage
Create a SecretProviderClass resource
Create a pod with a mounted secret
Delete the resources you created
See also

HashiCorp Vault is an open-source tool for securely storing and accessing secrets (e.g., passwords, certificates, and tokens).

Configure storage of secrets and access to them inside a Yandex Managed Service for Kubernetes cluster using a Yandex Cloud Marketplace product called HashiCorp Vault with Key Management Service support.

This guide describes a use case of mounting a secret from HashiCorp Vault using a Container Storage Interface (CSI) volume.

To enable access to a secret in a Managed Service for Kubernetes cluster using HashiCorp Vault:

If you no longer need the resources you created, delete them.

Required paid resources

The support cost includes:

Fee for the Managed Service for Kubernetes cluster: using the master and outgoing traffic (see Managed Service for Kubernetes pricing).
Cluster nodes (VM) fee: using computing resources, operating system, and storage (see Compute Cloud pricing).
Fee for a public IP address assigned to cluster nodes (see Virtual Private Cloud pricing).
Key Management Service fee: number of active key versions (with Active or Scheduled For Destruction for status) and completed cryptographic operations (see Key Management Service pricing).

Get your cloud ready

Create a Kubernetes cluster and node group.
Manually

Using Terraform
1. If you do not have a network yet, create one.
2. If you do not have any subnets yet, create them in the availability zones where your Kubernetes cluster and node group will be created.
3. Create service accounts:
  - Service account with the k8s.clusters.agent and vpc.publicAdmin roles for the folder where the Kubernetes cluster is created. This service account will be used to create the resources required for the Kubernetes cluster.
  - Service account with the container-registry.images.puller role. Nodes will pull the required Docker images from the registry on behalf of this account.
  Tip
  
  You can use the same service account to manage your Kubernetes cluster and its node groups.
4. Create security groups for the Managed Service for Kubernetes cluster and its node groups.
  
  Warning
  
  The configuration of security groups determines the performance and availability of the cluster and the services and applications running in it.
5. Create a Kubernetes cluster and a node group in any suitable configuration. When creating them, specify the security groups prepared earlier.
1. If you do not have Terraform yet, install it.
2. Get the authentication credentials. You can add them to environment variables or specify them later in the provider configuration file.
3. Configure and initialize a provider. There is no need to create a provider configuration file manually, you can download it.
4. Place the configuration file in a separate working directory and specify the parameter values. If you did not add the authentication credentials to environment variables, specify them in the configuration file.
5. Download the k8s-cluster.tf cluster configuration file to the same working directory. This file describes:
  - Network.
  - Subnet.
  - Kubernetes cluster.
  - Service account required for the Managed Service for Kubernetes cluster and node group to operate.
  - Security groups which contain rules required for the Managed Service for Kubernetes cluster and its node groups.
    
    Warning
    
    The configuration of security groups determines the performance and availability of the cluster and the services and applications running in it.
6. Specify the following in the k8s-cluster.tf file:
  - Folder ID.
  - Kubernetes version for the Kubernetes cluster and node groups.
  - Kubernetes cluster CIDR.
  - Name of the Managed Service for Kubernetes cluster service account.
7. Check that the Terraform configuration files are correct using this command:
  terraform validate
  If there are any errors in the configuration files, Terraform will point them out.
8. Create the required infrastructure:
  1. Run this command to view the planned changes:
    
    terraform plan
    
    If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
  2. If everything looks correct, apply the changes:
    
    Run this command:
    
    terraform apply
    
    Confirm updating the resources.
    
    Wait for the operation to complete.
  All the required resources will be created in the specified folder. You can check resource availability and their settings in the management console.
Install kubect and configure it to work with the new cluster.

Install HashiCorp Vault

Install HashiCorp Vault using Helm and initialize the storage according to instructions. In the installation command, specify the hcv namespace and add the extra parameters to activate the Vault CSI provider mechanism:

--namespace hcv \
--set "injector.enabled=false" \
--set "csi.enabled=true"

Run a HashiCorp Vault interactive shell session for the hashicorp-vault-0 pod:
```
kubectl exec -it hashicorp-vault-0 \
   --namespace hcv \
   -- /bin/sh
```
Unseal the storage:
```
vault operator unseal
```
Enter one of the recovery keys (Recovery Key) you got during storage initialization.
Log in to HashiCorp Vault using the root token:
```
vault login
```
Enter the root token (Initial Root Token) you got during storage initialization.

Create a secret

Enable the kv secret mechanism at the secret path:
```
vault secrets enable -path=secret kv
```
Create a secret at secret/db-pass. Specify a password as a secret:
```
vault kv put secret/db-pass password="12345678"
```

Make sure the secret is available for reading at secret/db-pass:

vault kv get secret/db-pass

Result:

====== Data ======
Key         Value
---         -----
password    12345678

Configure the Kubernetes authentication method

This method will allow you to log in using a Kubernetes service account token.

Enable the Kubernetes authentication method:
```
vault auth enable kubernetes
```
Configure authentication with Kubernetes API address:
```
vault write auth/kubernetes/config \
   kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443"
```
The KUBERNETES_PORT_443_TCP_ADDR environment variable refers to the internal network address of the Kubernetes node.
Create a policy named internal-app that will allow the Kubernetes service account to read the secret created earlier:
```
vault policy write internal-app - <<EOF
path "secret/db-pass" {
  capabilities = ["read"]
}
EOF
```
Create the database role that will link the internal-app policy to the Kubernetes webapp-sa service account (you will create it later):
```
vault write auth/kubernetes/role/database \
   bound_service_account_names=webapp-sa \
   bound_service_account_namespaces=hcv \
   policies=internal-app \
   ttl=20m
```
Tokens returned after authentication will be valid for 20 minutes.
Exit HashiCorp Vault:
```
exit
```

Install the SCI driver for the secret storage

Add a Helm repository named secrets-store-csi-driver:

helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts

Install the SCI driver:

helm install csi secrets-store-csi-driver/secrets-store-csi-driver \
   --namespace=hcv \
   --set syncSecret.enabled=true

Make sure the driver is running and ready:

kubectl get pods -n hcv -l "app=secrets-store-csi-driver"

Result:

NAME                                 READY   STATUS    RESTARTS   AGE
csi-secrets-store-csi-driver-nbxcd   3/3     Running   0          4m28s

Create a SecretProviderClass resource

Create a file named spc-vault-database.yaml with settings that are provided to the CSI provider:

spc-vault-database.yaml

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: vault-database
spec:
  provider: vault
  parameters:
    vaultAddress: "http://hashicorp-vault.hcv:8200"
    roleName: "database"
    objects: |
      - objectName: "db-password"
        secretPath: "secret/db-pass"
        secretKey: "password"

Create a resource named SecretProviderClass:

kubectl apply -f spc-vault-database.yaml -n hcv

Create a pod with a mounted secret

Create a service account named webapp-sa for the Kubernetes cluster:
```
kubectl create serviceaccount webapp-sa \
   --namespace hcv
```

Create a file named webapp-pod.yaml containing the webapp pod configuration:

spc-vault-database.yaml

kind: Pod
apiVersion: v1
metadata:
  name: webapp
spec:
  serviceAccountName: webapp-sa
  containers:
  - image: jweissig/app:0.0.1
    name: webapp
    volumeMounts:
    - name: secrets-store-inline
      mountPath: "/mnt/secrets-store"
      readOnly: true
  volumes:
    - name: secrets-store-inline
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: "vault-database"

Create a pod named webapp:

kubectl apply -f webapp-pod.yaml -n hcv

Make sure the webapp pod is running and ready:

kubectl get pod webapp -n hcv

Result:

NAME     READY   STATUS    RESTARTS   AGE
webapp   1/1     Running   0          5m25s

Display the secret password recorded to the file system at /mnt/secrets-store/db-password:
```
kubectl exec webapp -n hcv -- cat /mnt/secrets-store/db-password
```
Result:
```
12345678
```

Delete the resources you created

Some resources are not free of charge. Delete the resources you no longer need to avoid paying for them.

Manually

Using Terraform

In the terminal window, go to the directory containing the infrastructure plan.

Warning

Make sure the directory has no Terraform manifests with the resources you want to keep. Terraform deletes all resources that were created using the manifests in the current directory.
Delete resources:
1. Run this command:
```
terraform destroy
```
2. Confirm deleting the resources and wait for the operation to complete.
All the resources described in the Terraform manifests will be deleted.

Using HashiCorp Vault to store secrets

Required paid resourcesRequired paid resources

Get your cloud readyGet your cloud ready

Install HashiCorp VaultInstall HashiCorp Vault

Log in to HashiCorp VaultLog in to HashiCorp Vault

Create a secretCreate a secret

Configure the Kubernetes authentication methodConfigure the Kubernetes authentication method

Install the SCI driver for the secret storageInstall the SCI driver for the secret storage

Create a SecretProviderClass resourceCreate a SecretProviderClass resource

Create a pod with a mounted secretCreate a pod with a mounted secret

Delete the resources you createdDelete the resources you created

See alsoSee also

Was the article helpful?

Required paid resources

Get your cloud ready

Install HashiCorp Vault

Log in to HashiCorp Vault

Create a secret

Configure the Kubernetes authentication method

Install the SCI driver for the secret storage

Create a SecretProviderClass resource

Create a pod with a mounted secret

Delete the resources you created

See also