{"id":7611,"date":"2020-05-13T09:06:57","date_gmt":"2020-05-13T09:06:57","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/use-the-azure-secret-store-csi-driver-in-aks\/"},"modified":"2026-11-03T19:28:46","modified_gmt":"2026-11-03T19:28:46","slug":"use-the-azure-secret-store-csi-driver-in-aks","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/use-the-azure-secret-store-csi-driver-in-aks\/","title":{"rendered":"Use the Azure Secret Store CSI driver in AKS"},"content":{"rendered":"

If you have been using Azure\u00ae Key Vault FlexVolume for Azure Kubernetes Service (AKS), it is time to switch over to the new provider. Azure deprecated the FlexVolume solution in favor of the Azure Key Vault Provider for Secret Store CSI Driver<\/a>. The Azure Key Vault provider for the Secret Store CSI driver<\/a> has a simple configuration that makes deployment and governance around keys, secrets, and certificates feel like any other Azure resource talking to the key vault. Let’s take a look at a complete example from provisioning an AKS cluster to reading in a secret as an environmental variable.<\/p>\n

 Provision infrastructure for the demo<\/strong><\/p>\n

Before you can pass secrets into an AKS cluster, provision a key vault and add a secret into the vault:<\/p>\n

    az group create –location $location –name $kvRg 
\n    az keyvault create –location $location –name $kvName –resource-group $kvRg –enable-soft-delete $fals<\/em>e<\/p>\n

    #add secret to key vault
\n    $pw = [System.Web.Security.Membership]::GeneratePassword(12, 2)
\n    az keyvault secret set –vault-name $kvName –name mssql-secret –value $pw
\n    az keyvault secret show –name mssql-secret –vault-name $kvName<\/em><\/p>\n

I recommend an AKS cluster with a Kubernetes\u00ae version of 1.16.0 or greater. Configure the cluster with the following code:<\/p>\n

    az group create –name $aksRg –location $location
\n    az aks create `
\n       –resource-group $aksRg `
\n       –name $aksName `
\n       –node-count 1 `
\n       –kubernetes-version 1.16.7 `
\n       –generate-ssh-keys `
\n       –enable-vmss `
\n       –vm-set-type VirtualMachineScaleSets `
\n       –load-balancer-sku standard `
\n       –network-plugin azure `
\n       –enable-managed-identity <\/em><\/p>\n

Because this process passes the –enable-managed-identity<\/strong> switch, you need to pull out the managed identity ID. Use this ID to assign the Managed Identity Operator<\/strong> and Virtual Machine Contributor<\/strong> role to the `AKS MC_`<\/em> resource group:<\/p>\n

    #get access creds for cluster
\n    az aks get-credentials –resource-group $aksRg –name $aksName<\/em><\/p>\n

    #get our managed identity id
\n    $subscriptionId = az account show –query id –output tsv
\n    $identity = az aks show -g $aksRg -n $aksName –query identityProfile.kubeletidentity.clientId -o tsv<\/em><\/p>\n

    az role assignment create –role “Managed Identity Operator” –assignee $identity –scope          “\/subscriptions\/$subscriptionId\/resourcegroups\/MC_$($aksName)_$($aksName)_southcentralus”
\n    az role assignment create –role “Virtual Machine Contributor” –assignee $identity –scope “\/subscriptions\/$subscriptionId\/resourcegroups\/MC_$($aksName)_$($aksName)_southcentralus”<\/em><\/p>\n

\nSet the access policy to allow the preceding identity to permit GET operations for keys, secrets, and certificates.<\/p>\n

    # set policy to access keys in your Key Vault
\n    az keyvault set-policy -n $kvName –key-permissions get –spn $identity
\n    # set policy to access secrets in your Key Vault
\n    az keyvault set-policy -n $kvName –secret-permissions get –spn $identity
\n    # set policy to access certs in your Key Vault
\n    az keyvault set-policy -n $kvName –certificate-permissions get –spn $identity<\/em><\/p>\n

Use HELM\u00ae to install the driver:<\/p>\n

    helm repo add csi-secrets-store-provider-azure https:\/\/raw.githubusercontent.com\/Azure\/secrets-store-csi-driver-provider-azure\/master\/charts
\n    helm install csi-secrets-store-provider-azure\/csi-secrets-store-provider-azure –generate-name<\/em><\/p>\n

    #Verify pods being created and on which specific node (linux and windows node)
\n    kubectl get pods -o wide<\/em><\/p>\n

Create a secretproviderclasses resource <\/strong><\/p>\n

Create a yml file called kv-sqldemo.yml<\/strong> and paste the following code. Configure the following values in secretObjects<\/strong>, objects<\/strong> and objectType<\/strong> in the yml file: <\/p>\n

\n– useVMManagedIdentity<\/strong>
\n– userAssignedIdentityID<\/strong>
\n– keyvaultName<\/strong>
\n– secretName<\/strong>
\n– key<\/strong>
\n– objectName<\/strong><\/p>\n

\nBecause you provisioned the AKS cluster with the enabled managed identity, you need to set two parameters: useVMManagedIdentity<\/strong> and userAssignedIdentityID<\/strong><\/p>\n

The `$identity<\/em>` variable stores the userAssignedIdentityID<\/strong>. If you do not specify **secretObjects<\/strong>**, you can only mount a volume. The system uses secretObjects<\/strong> to sync and create a Kubernetes secret. You can use this to set environmental variables in your deployment yml file. The secretObject name matches what you specified in the key vault. The deployment file uses the key to match and bring the secret in. Kubernetes creates, names, and uses this secret name.<\/p>\n

kv-sqldemo.yml** code:<\/em><\/p>\n

    apiVersion: secrets-store.csi.x-k8s.io\/v1alpha1
\n    kind: SecretProviderClass
\n    metadata:
\n      name: azure-sync
\n    spec:
\n      provider: azure
\n      secretObjects:                   # [OPTIONAL] SecretObject defines the desired state of synced K8s secret objects
\n      – secretName: mssql              # name of the Kubernetes Secret object
\n        type: Opaque
\n        data: 
\n        – objectName: “mssql-secret”   # name of the mounted content to sync, such as the object name or object alias 
\n          key: mssql                   # data field to populate. This must match in deployment yaml for key
\n     parameters:
\n        useVMManagedIdentity: “true”
\n        userAssignedIdentityID: “7a1374c4-e517-4cdd-a655-85da17056c95”
\n        keyvaultName: “jrakskv”        # the name of the KeyVault
\n        objects: |
\n           array:
\n             – |
\n              objectName: mssql-secret # key vault secret name
\n              objectType: secret       # object types: secret, key or cert
\n        tenantId: “<insert tenantId here>” # the tenant ID of the KeyVault<\/em><\/p>\n

Run `kubectl apply -f .\\kv-sqldemo.yml` to apply our configuration.<\/em><\/p>\n

Create a Microsoft\u00ae; SQL Server\u00ae (MS SQL) instance that pulls the mssql-secret generated during the key vault deployment as the System Administrator (SA) password.<\/p>\n

 —
\n    apiVersion: “v1”
\n    kind: “ConfigMap”
\n    metadata:
\n      name: “mssql-config-map”
\n      namespace: default
\n      labels:
\n        app: mssql
\n    data:
\n      MSSQL_PID: “Developer”
\n      ACCEPT_EULA: “Y”
\n    —
\n    apiVersion: “v1”
\n    kind: “Service”
\n    metadata:
\n      name: “mssql” #$(service name).$(namespace).svc.cluster.local
\n      labels:
\n        app: mssql
\n    spec:
\n      clusterIP: “None”
\n      ports:
\n      – port: 1433
\n        name: “mssql”
\n      selector:
\n        app: “mssql”
\n        release: “mssql”
\n    —
\n    apiVersion: v1
\n    kind: Service
\n    metadata:
\n      name: mssql-lb
\n      labels:
\n        app: mssql  
\n    spec:
\n      selector:
\n        app: mssql
\n      ports:
\n        – protocol: TCP
\n          port: 1433
\n          targetPort: 1433
\n      type: LoadBalancer
\n    —
\n    apiVersion: apps\/v1
\n    kind: StatefulSet
\n    metadata:
\n     name: mssql 
\n     labels:
\n       app: mssql
\n       release: mssql
\n    spec:
\n      serviceName: “mssql”
\n      selector:
\n        matchLabels:
\n          app: “mssql”
\n         release: “mssql”
\n      replicas: 1
\n      updateStrategy:
\n        type: OnDelete
\n      template:
\n       metadata:
\n          labels:
\n            app: “mssql”
\n            release: “mssql”
\n        spec:
\n          nodeSelector:
\n            “beta.kubernetes.io\/os”: linux  
\n          terminationGracePeriodSeconds: 180
\n          volumes:
\n            – name: secrets-store-inline
\n              csi:
\n                driver: secrets-store.csi.k8s.io
\n                readOnly: true
\n                volumeAttributes:
\n                  secretProviderClass: “azure-sync” 
\n         containers:
\n            – name: mssql
\n              image: mcr.microsoft.com\/mssql\/server:2017-latest          
\n              resources:
\n                {}
\n              ports:
\n              – containerPort: 1433
\n                name: mssql
\n              envFrom:
\n                – configMapRef:
\n                    name: mssql-config-map
\n              env:
\n                – name: MSSQL_PID
\n                  valueFrom:
\n                    configMapKeyRef:
\n                      name: mssql-config-map
\n                      key: MSSQL_PID
\n                – name: ACCEPT_EULA
\n                  valueFrom:
\n                    configMapKeyRef:
\n                      name: mssql-config-map
\n                      key: ACCEPT_EULA
\n                – name: SA_PASSWORD #env variable to create
\n                  valueFrom:
\n                    secretKeyRef:
\n                      name: mssql #k8s secret name. (kubectl get secret). this is auto synced during creation and deletion of the POD
\n                      key: mssql #this must match the kv configuration in the yaml under secretObjects
\n              volumeMounts:
\n                – name: mssql-pvc
\n                  mountPath: \/var\/opt\/mssql
\n                – name: secrets-store-inline 
\n                  mountPath: “\/mnt\/secrets-store”
\n                 readOnly: true
\n      volumeClaimTemplates: #default is standard storage. managed-premium is ssd
\n        – metadata:
\n            name: mssql-pvc      
\n          spec:
\n           storageClassName: default
\n            accessModes:
\n              – ReadWriteOnce
\n            resources:
\n              requests:
\n               storage: 4Gi<\/em><\/p>\n

\nNote<\/strong>: You must create a volume with a secretProviderClass<\/strong> that matches the name you specified in the secretproviderclasses<\/strong> resource that you created previously. <\/p>\n

Mount a volume with access to your secrets. This exposes secrets so that a script can output the value, as shown here:<\/p>\n

        – name: secrets-store-inline
\n          csi:
\n            driver: secrets-store.csi.k8s.io
\n            readOnly: true
\n            volumeAttributes:
\n              secretProviderClass: “azure-sync” <\/em><\/p>\n

            – name: secrets-store-inline 
\n              mountPath: “\/mnt\/secrets-store”
\n              readOnly: true<\/em><\/p>\n

Finally, apply our mssql yml file by running this command: <\/p>\n

`k apply -f .\\mssqlStateful.yml`<\/em><\/p>\n

After the pod starts and the secret syncs, verify that the password is set as an environmental variable:<\/p>\n

    kubectl get pods<\/em><\/p>\n

    NAME                                                              READY   STATUS    RESTARTS   AGE
\n    csi-secrets-store-provider-azure-1589209035-secrets-store-pwnsz   3\/3     Running   0          29m
\n    csi-secrets-store-provider-azure-1589209035-xcqz9                 1\/1     Running   0          29m
\n    mssql-0                                                           1\/1     Running   0          6m30s<\/em><\/p>\n

    kubectl get secret<\/em><\/p>\n

    NAME                                                                TYPE                                  DATA   AGE
\n    default-token-7hvrq                                                 kubernetes.io\/service-account-token   3      37m
\n    mssql                                                               Opaque                                1      10m
\n    secrets-store-csi-driver-token-bdsjk                                kubernetes.io\/service-account-token   3      33m
\n    sh.helm.release.v1.csi-secrets-store-provider-azure-1589209035.v1   helm.sh\/release.v1                    1      33m<\/em><\/p>\n

    kubectl exec -t mssql-0 printenv | findstr SA_PASSWORD    
\n    SA_PASSWORD=fjL-dh.hq0!4<\/em><\/p>\n

You can also grab the public IP address of the load balancer and connect to it by using SQL Management Studio with the SA account by using the password set from Azure Key Vault:<\/p>\n

    kubectl get service -l app=mssql<\/p>\n

    NAME       TYPE           CLUSTER-IP   EXTERNAL-IP   PORT(S)          AGE
\n    mssql      ClusterIP      None         <none>        1433\/TCP         20m
\n    mssql-lb   LoadBalancer   10.0.7.128   40.119.2.73   1433:31264\/TCP   20m<\/em>
\n <\/p>\n

\"SSMS<\/p>\n

\nUsing Azure Key Vault with AKS has never been easier. I hope this demo shows some possibilities of things that you can accomplish easily with the Azure Key Vault provider. <\/p>\n","protected":false},"excerpt":{"rendered":"

Use the Azure Secret Store CSI driver in AKS<\/p>\n","protected":false},"author":2,"featured_media":7613,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26451","content_type":"blog","created_by":"10130","authored_on":"2024-01-05T10:06:57+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technical Staff","seo_description":"Utilize Azure Secret Store CSI Driver in AKS for enhanced security and configuration. Simplify deployment and integration with keys and secrets.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26451-insights_image-microsoft-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Microsoft Azure","product":"","publisheddate":"2020-05-13T09:06:57","rxt_solutions":"Cloud Management & Operations","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Azure Secret Store CSI driver in AKS | Rackspace Technology","field_topics":"","field_slug":"using-the-azure-secrets-store-csi-in-aks-driver","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7611","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7611","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=7611"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7611\/revisions"}],"predecessor-version":[{"id":9565,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7611\/revisions\/9565"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/7613"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=7611"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=7611"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=7611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}