Kubernetes secrets: HashiCorp Vault Watch: https://www.youtube.com/watch?v=B16YTeSs1hI HashiCorp Vault KMS plugin for Kubernetes ● Secrets are in etcd, with root of trust in Vault Kubernetes auth backend backend for HashiCorp Vault ● Authenticate to Vault using a K8s service account Kubernetes secrets: requirements Kubernetes default Identity External secrets provider 1.7 EncryptionConfig 1.10 Azure Key Vault: https://github.com/Azure/kubernetes-kms ● AWS KMS: https://github.com/kubernetes-sigs/aws-encryption-provider ● HashiCorp Vault: https://github.com/oracle/kubernetes-vault-kms-plugin

node2 node3 node4 node5 [etcd] node1 node2 node3 [calico-rr] [vault] node1 node2 node3 使⽤ansible playbook部署kubespray ~]# ansible-playbook -i inventory/mycluster/hosts