2

I'm following this Microsoft document to integrate AKS with KeyVault: https://docs.microsoft.com/en-us/azure/aks/csi-secrets-store-driver

I'm using Sitecore 10.1.0 that uses AKS, my idea is to sync the secrets into the pods without using Kubernetes secrets because they are not secure as per this document.

My question here is: How do I specify this path on Windows containers? Is there a specific folder that I should point to? Or is it a random folder that will be created during the runtime? enter image description here

And also, once the secrets are mounted in the pod, how do I pass the secrets in the deployment of the Sitecore roles? enter image description here

The example in the document is just to list the secrets that were mounted, and not to pass them in the yaml:

kubectl exec busybox-secrets-store-inline -- ls /mnt/secrets-store/

1 Answer 1

2

The current Sitecore implementation (SC 10.1 and earlier versions since I believe SC 9.2) is configured to support the Microsoft.Configuration.ConfigurationBuilders.EnvironmentConfigBuilder configuration builder provider type, reading connection strings and app settings from environment variables.

The Secrets Store CSI driver secrets-store.csi.k8s.io allows Kubernetes to mount multiple secrets, keys, and certs stored in the Azure Key Vault resource into pods as a volume. Once the Volume is attached, the data in it is mounted into the container’s file system. Since the secrets are not stored in environment variables but available in the file system of the container, you need to use a different configuration builder type to access them, the Key-Per-File Configuration Provider. The official Microsoft documentation shows an example on how to use this provider to add configurations from files stored in a folder in the file system (its path would be the path of the mounted /mnt/secrets-store folder). I haven't personally tried it and it would require a good number of changes!

An alternative easier approach supported by Sitecore that doesn't require to modify the Sitecore out-of-the-box configuration builder is to sync the mounted CSI file system secrets with Kubernetes Secrets, using the optional secretObjects field in the SecretProviderClass specification to map secrets using their objectName, as explained on the CSI driver official documentation here and on the Sitecore documentation portal here. Kubernetes secrets are already loaded as environment variables in the individual pod specification manifests, using the secretKeyRef field. While this approach is still less secure than reading the secrets from the file system, it eliminates one of the risks documented on the Kubernetes secrets documentation page that you linked in your question:

If you configure the secret through a manifest (JSON or YAML) file which has the secret data encoded as base64, sharing this file or checking it in to a source repository means the secret is compromised. Base64 encoding is not an encryption method and is considered the same as plain text.

One final note. The Secrets Store CSI driver for AKS is still in preview and as mentioned in the official documentation, preview features are not meant for production use:

AKS preview features are available on a self-service, opt-in basis. Previews are provided "as is" and "as available," and they're excluded from the service-level agreements and limited warranty. AKS previews are partially covered by customer support on a best-effort basis. As such, these features aren't meant for production use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.