The Vault Secrets Operator has achieved Red Hat OpenShift operator certification, allowing OpenShift users to easily install and deploy secrets management on their OpenShift clusters.
HashiCorp Vault: identity-based security to manage access to secrets and protect sensitive data
HashiCorp is a leading provider of multi-cloud infrastructure automation and security software. One of their flagship products, Vault, provides organizations with identity-based security to automatically authenticate and authorize access to secrets and other sensitive information on the cluster.
Kubernetes secret management
There are numerous tools to use to manage secrets. When deciding which ones to use, developers or operators need to address several key challenges:
- Secure storage of the secrets
- Access control
- Managing secrets at scale
- Compliance restrictions
- Secrets rotation
Kubernetes secrets are consumed multiple ways: through files in volumes mounted by containers, container environment variables, or via the Secrets API by an application running on the cluster. Kubernetes natively supports the management and distribution of secrets within the cluster, but it does not support dynamic secrets or secret rotation. These additional functions are left up to the user to manage independently or via additional services.
Using Vault for a complete secrets management solution provides your organization with several benefits, including:
- Reducing security risks and incidents
- Reducing manual effort through automation
- Cost savings
- Increased efficiency
*New* Vault Secrets Operator
HashiCorp Vault provides a complete and comprehensive solution for secrets lifecycle management. However, it also requires users to upskill and learn an entirely new tool and system. Developers and operators need to save time where they can, and they need to focus on meaningful work. They want a cloud-native way to access secrets through Kubernetes without having to deeply understand the Vault product.
Through the newly GA’d Vault Secrets Operator, secrets are accessed as native Kubernetes secrets while still managed by Vault.
The Vault Secrets Operator also enables SecOps to have more control over operational boundaries within engineering teams. SecOps can define, enforce, and control security policies and leverage auditing and monitoring capabilities provided by Vault for access and permissions. This enables overall best practices for secrets management without involving or interacting with developers or complicating application code.
How it works
Kubernetes operators, through the extension of the Kubernetes API, automate and simplify the management of complex applications on Kubernetes clusters.
The Vault Secrets Operator syncs secrets between Vault and Kubernetes natively, in a specified namespace where the applications have access to the secrets. This configuration enables secrets management with Vault using standard Kubernetes integration.
The operator watches for changes to the supported set of Custom Resource Definitions (CRDs) that it manages. These CRDs provide the specifications needed for the operator to synchronize a Vault secret to a Kubernetes secret. The operator writes source Vault secret data directly to the destination Kubernetes secret via the Kubernetes API server. This ensures that as the source changes, the destination changes with it over its lifetime. An application only needs access to the native Kubernetes destination secret to make use of the secret data.
The new operator build, deployable directly from the embedded OperatorHub within the OpenShift console, is the preferred method of managing CRDs, and provides an enhanced installation and upgrade management experience. You may also deploy the operator by using Helm or kustomize.
Getting started
Now that the Vault Secrets Operator is Red Hat certified, you can find and install it directly from the embedded OperatorHub of any OpenShift Container Platform within the administrator console, versions 4.10 through 4.13, and follow their official documentation.
Further Reading
- Vault Secrets Operator documentation for OpenShift
- Vault Secrets Operator tutorial
- Vault Secrets Operator GA blog announcement
Acknowledgments
- David Mills, Senior Technical Product Marketing Manager, HashiCorp
- Steve Almy, Senior Product Manager, HashiCorp
저자 소개
유사한 검색 결과
채널별 검색
오토메이션
기술, 팀, 인프라를 위한 IT 자동화 최신 동향
인공지능
고객이 어디서나 AI 워크로드를 실행할 수 있도록 지원하는 플랫폼 업데이트
오픈 하이브리드 클라우드
하이브리드 클라우드로 더욱 유연한 미래를 구축하는 방법을 알아보세요
보안
환경과 기술 전반에 걸쳐 리스크를 감소하는 방법에 대한 최신 정보
엣지 컴퓨팅
엣지에서의 운영을 단순화하는 플랫폼 업데이트
인프라
세계적으로 인정받은 기업용 Linux 플랫폼에 대한 최신 정보
애플리케이션
복잡한 애플리케이션에 대한 솔루션 더 보기
오리지널 쇼
엔터프라이즈 기술 분야의 제작자와 리더가 전하는 흥미로운 스토리
제품
- Red Hat Enterprise Linux
- Red Hat OpenShift Enterprise
- Red Hat Ansible Automation Platform
- 클라우드 서비스
- 모든 제품 보기
툴
체험, 구매 & 영업
커뮤니케이션
Red Hat 소개
Red Hat은 Linux, 클라우드, 컨테이너, 쿠버네티스 등을 포함한 글로벌 엔터프라이즈 오픈소스 솔루션 공급업체입니다. Red Hat은 코어 데이터센터에서 네트워크 엣지에 이르기까지 다양한 플랫폼과 환경에서 기업의 업무 편의성을 높여 주는 강화된 기능의 솔루션을 제공합니다.