In this lesson, you will learn how to decouple sensitive credentials from your GitOps pipelines by leveraging HashiCorp Vault to inject secrets dynamically into your Kubernetes pods.
The Problem: GitOps and Secret Exposure
In a GitOps workflow, your infrastructure state is defined in plaintext files within a repository. While Kubernetes Secrets allow you to store sensitive data, committing these files—even if base64 encoded—is a major security risk. Furthermore, managing the lifecycle of these secrets across different environments manually often leads to configuration drift.
The Solution: External Secret Injection
Instead of storing actual values in Git, we integrate HashiCorp Vault. By using the Vault Agent Injector, we modify our Kubernetes deployments to include specific annotations. When a pod is deployed, the Vault agent intercepts the request, retrieves the secret from the secure Vault engine, and mounts it into the container’s filesystem or environment variables.
To your application, the secret appears to be a standard file or variable, but it never existed in your Git repository.
Practical Implementation
In your Kubernetes deployment manifest, you simply define the path to the secret in Vault:
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-app
annotations:
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/role: "my-app-role"
vault.hashicorp.com/agent-inject-secret-config.json: "secret/data/my-app/config"
spec:
template:
metadata:
annotations:
vault.hashicorp.com/agent-inject: "true"
...
When this pod starts, the Vault agent creates a sidecar that fetches the data from secret/data/my-app/config and renders it at /vault/secrets/config.json. Your application simply reads this local file. Since the secret is never committed to Git, your GitOps source of truth remains clean, secure, and compliant. This approach allows you to rotate secrets in Vault instantly, and the pods will receive the updated values upon a rolling restart, maintaining the desired state without human intervention.
Key Takeaway: By using the Vault Agent Injector, you replace hardcoded, risky credentials in Git with dynamic, ephemeral references that ensure sensitive data is only ever resolved within the runtime environment.