How do you integrate Kubernetes with HashiCorp Vault? How to inject secrets declaratively?

Integration of Kubernetes with HashiCorp Vault allows secure management and injection of secrets into pods without storing them in manifests.

Main methods of integration:

1. Vault Agent Injector — a sidecar container that automatically retrieves secrets from Vault and mounts them into the pod as files or environment variables.

2. CSI Driver for Vault — allows mounting secrets as volumes in pods declaratively via Volume.

3. Using Kubernetes Auth Method in Vault — pods authenticate to Vault using Kubernetes service accounts.

Declarative example with Vault Agent Injector:

apiVersion: v1
kind: Pod
metadata:
  name: example-pod
  annotations:
    vault.hashicorp.com/agent-inject: "true"
    vault.hashicorp.com/role: "k8s-role"
    vault.hashicorp.com/agent-inject-secret-config.txt: "secret/data/myapp/config"
spec:
  serviceAccountName: vault-auth
  containers:
  - name: app
    image: myapp:latest
    volumeMounts:
    - name: vault-secrets
      mountPath: /vault/secrets
  volumes:
  - name: vault-secrets
    emptyDir: {}

In this example, Vault Agent automatically retrieves secrets from the path secret/data/myapp/config and mounts them into the container. All configurations are done through annotations and Kubernetes manifests, ensuring declarativity and security.