AKS - Keyvault Integration: Can I use mounted secrets volume with .Net Core configuration

Question

AKS - Keyvault Integration: Can I use mounted secrets volume with .Net Core configuration

Anonymous

Hi
I have an ASP Net Core 3.1 application hosted in a container in AKS. I want it to be able to access secrets and certificates stored in Keyvault.
I was able to follow this guide successfully all the way to being able to checking that the secret is successfully in the secret volume.
https://learn.microsoft.com/en-us/azure/key-vault/general/key-vault-integrate-kubernetes

But now what? Do I need to access this secret as a file stored on the file directory from my ASP Net Core application? or is there a way to hook this up to Configuration the way we usually do without AKS so that accessing Keyvault secrets is seamless?

Also, I'm unclear if after following this guide, the secrets are only loaded from Keyvault once, and stored, or will they automatically get updated if the secret is changed in Keyvault.

Thanks
Sam

prmanhas-MSFT 17,946 Reputation points Microsoft Employee Moderator

2020-08-24T16:29:25.187+00:00

@Anonymous Any update on the issue?

If the suggested response helped you resolve your issue, do click on "Mark as Answer" and "Up-Vote" for the answer that helped you for benefit of the community.

Thanks.
Josh Williams 1 Reputation point

2021-01-21T05:43:09.957+00:00

So, I realize this answer has been accepted. But it didn't answer the actual question:

How do you get from this mounted folder of inline secrets in aks to an ASP.NET Core environmental variable / config value?

In ASP.NET core, you can add various sources of variables (appsettings, environmental variables, even ... Azure key vault source)

But the asp.net core key vault docs tall only about using "app services" managed identities (https://learn.microsoft.com/en-us/aspnet/core/security/key-vault-configuration?view=aspnetcore-5.0#use-managed-identities-for-azure-resources), not AKS managed identities from running pods.

Will this work? Or do we need to write a CSI custom provider to look in a specific folder where these vault keys are mounted?

At least that is what I feel like the OP was asking, I may be wrong.

Accepted answer

0 additional answers

Your answer

prmanhas-MSFT 17,946 Reputation points Microsoft Employee Moderator

2020-08-24T16:29:25.187+00:00

@Anonymous Any update on the issue?

If the suggested response helped you resolve your issue, do click on "Mark as Answer" and "Up-Vote" for the answer that helped you for benefit of the community.

Thanks.
Josh Williams 1 Reputation point

2021-01-21T05:43:09.957+00:00

So, I realize this answer has been accepted. But it didn't answer the actual question:

How do you get from this mounted folder of inline secrets in aks to an ASP.NET Core environmental variable / config value?

In ASP.NET core, you can add various sources of variables (appsettings, environmental variables, even ... Azure key vault source)

But the asp.net core key vault docs tall only about using "app services" managed identities (https://learn.microsoft.com/en-us/aspnet/core/security/key-vault-configuration?view=aspnetcore-5.0#use-managed-identities-for-azure-resources), not AKS managed identities from running pods.

Will this work? Or do we need to write a CSI custom provider to look in a specific folder where these vault keys are mounted?

At least that is what I feel like the OP was asking, I may be wrong.

Answer 1

prmanhas-MSFT 17,946 Microsoft Employee Moderator

@Anonymous Using the pod identity project enables authentication against supporting Azure services. For your own services or applications without managed identities for Azure resources, you can still authenticate using credentials or keys. Key vault can be used to store these secret contents.

When applications need a credential, they communicate with the digital vault, retrieve the latest secret contents, and then connect to the required service. The simplified workflow for retrieving a credential from Azure Key Vault using pod managed identities is shown in the following diagram:

With Key Vault, you store and regularly rotate secrets such as credentials, storage account keys, or certificates. You can integrate Azure Key Vault with an AKS cluster using the Azure Key Vault provider for the Secrets Store CSI Driver. The Secrets Store CSI driver enables the AKS cluster to natively retrieve secret contents from Key Vault and securely provide them only to the requesting pod. You can use a pod managed identity to request access to Key Vault and retrieve the secret contents needed through the Secrets Store CSI Driver.

You can read more about it here.

Your application can directly access the Secrets via Application since Managed Identity enable the application to have required access.

Fetching secret from Keyvault is dynamic process so whever you update secret it will be updated in mounted volume.

Hope it helps!!!

Please 'Accept as answer' if it helped, so that it can help others in the community looking for help on similar topics

John Lien 26 Reputation points

2020-09-04T17:10:56.207+00:00

@prmanhas-MSFT This doesn't answer this part of the question:

Do I need to access this secret as a file stored on the file directory from my ASP Net Core application? or is there a way to hook this up to Configuration the way we usually do without AKS so that accessing Keyvault secrets is seamless?
Darrell Tunnell 6 Reputation points

2020-12-14T10:26:15.85+00:00

Did you ever establish an answer on this? I wonder what the mounted secrets volume looks like to a .net core application - are they JSON files for example? or base 64 encoded files named by secret name? None of this is really clear is it..
Cosmin Sontu 1 Reputation point

2021-06-25T07:13:05.823+00:00

Once mounted, the volume containing the secrets will have each secret (key=value) stored as a file with he name "key" containing value as plain text.
Now the definitive answer would point you to a ASP.NET Configuration provider that can read config entries in this format : files in a folder, where filenames are keys and file contents are values.

I found the information on how secrets are store in the mounted volume here: https://azure.github.io/secrets-store-csi-driver-provider-azure/demos/standard-walkthrough/

I am not sure though if this is secure, considering anyone who can connect to pods and run commands can see the secrets.

Share via

AKS - Keyvault Integration: Can I use mounted secrets volume with .Net Core configuration

0 additional answers

Your answer