Using secrets from keyvault without synchronizing with kubernetes secrets (disruption after AKS 1.20.9 upgrade)

[ealasgarov]

After upgrading to AKS 1.20.9 secrets are not created anymore, it used to work before the upgrade, but now it doesn't. However, I don't mind not sync-ing to k8s secrets, I just want to reference it somehow directly.

The secret is mounted successfully in my pod, if i launch the command line to pod, I can see it under /mnt/secrets-store/mysecret.
I would like to refer to it directly, as to an environment variable for example. Is it possible, if yes, how?

Maybe like that somehow?

containers:

• env:
  • name: SomeName
    value: $(cat /mnt/secrets-store/SomeSecret)

If I am using standard form:

env:
- name: SECRET_USERNAME
  valueFrom:
    secretKeyRef:
      name: foosecret
      key: username

then the deployment fails, error: secret doesn't exist, if I create a kubernetes secret manually it is working fine.

Please suggest how to reference secrets from a mounted volume without creating kubernetes secret.

Thank you in advance!

[ealasgarov]

the problem was the flag in the helm chart:
syncSecret:
enabled: false

sssuka...

[nilekhc]

@ealasgarov Setting this flas would turn on Syncing secrets from mount to K8s Secret To get secrets in env var this is the only way as of now.

[ealasgarov]

ok, thanks for your reply.

perhaps I should not use values as env. variables, instead of env. var. to define the path to secret in application code, like "/mnt/secrets-store/mysecret", I will try that.

[nilekhc]

To get secrets in env var, the secrets must be created as K8s Secret. Then you can refer it in your deployment. Having said that, Secret Store CSI will only mirror the content of mount as k8s secret if syncSecret flag is set to true. We recommend using secrets from mount as it's more secure in sense that it's tmpfs mount and not persisted on disk.

However there are some use cases where we want secrets as K8s Secrets and could not use mount directly (for eg NGINX ingress controllers).

If you have to use k8s Secret then you should encrypt them with KMS Plugin for Key Vault.

[ealasgarov]

Thank you for your help, I will check KMS Plugin for Key Vault.
Additionally I will need to see what amendments are necessary to dockerfile/app code, to be able to use secrets directly from mount, because so far it wasn't working like that.