Secrets store providers
You can store sensitive information needed by your applications in an external secret management system and use the Secrets Store CSI Driver Operator to mount the secret content as a pod volume. Using an external secret store protects information that you do not want developers to have and can be more secure than secret objects.
The Secrets Store CSI Driver Operator has been tested with the following secrets store providers:
-
AWS Secrets Manager
-
AWS Systems Manager Parameter Store
-
Azure Key Vault
-
Google Secret Manager
-
HashiCorp Vault
|
|
IBM Z supports only HashiCorp Vault. |
|
|
Red Hat does not test all factors associated with third-party secrets store provider functionality. For more information about third-party support, see the "Red Hat third-party support policy". |
Automatic rotation
To maintain synchronization with your external secret provider, the Secrets Store CSI Driver Operator automatically rotates secret content in mounted volumes. The Secrets Store CSI Driver Operator uses this process to ensure that updates in the external store are automatically reflected in your pods and secrets.
If you enabled synchronization of mounted content as Kubernetes secrets, the Kubernetes secrets are also rotated.
Applications consuming the secret data must watch for updates to the secrets.