3 ms·
I'm not a fan of this approach. I think the Secrets Store CSI Driver (https://github.com/kubernetes-sigs/secrets-store-csi-driver https://github.com/kubernetes-
by dharmab 3y ago
I'm not a fan of this approach. I think the Secrets Store CSI Driver (https://github.com/kubernetes-sigs/secrets-store-csi-driver https://github.com/kubernetes-sigs/secrets-store-csi-driver) has a better approach. It mounts secrets directly from a KMS (e.g. Vault, AWS KMS, GCP KMS, Azure Key Vault) into your application's file system.
Why not environment variables? Because files have stronger access control mechanisms than environment variables. Someone in the same PID namespace as your process can see your environment variables, but they can't necessarily see your files.(Although the driver does support environment variables for compatibility: https://secrets-store-csi-driver.sigs.k8s.io/topics/set-as-env-var https://secrets-store-csi-driver.sigs.k8s.io/topics/set-as-e...)