AKS上のKubernetesの秘匿情報をAzure Key Vaultで管理する方法

kubectl create namespace secrets-test

az ad sp create-for-rbac --skip-assignment

az role assignment create \
   --role Reader \
   --assignee 00000000-0000-0000-0000-000000000000 \
   --scope /subscriptions/aaaa1234-12ab-34cd-56ef-1234abcd4567/resourceGroups/my-group/providers/Microsoft.KeyVault/vaults/my-key-vault
 
az keyvault set-policy \
   --name my-key-vault \
   --secret-permissions get \
   --spn 00000000-0000-0000-0000-000000000000

$ az keyvault show -n my-keyvault --query id -o tsv
/subscriptions/aaaa1234-12ab-34cd-56ef-1234abcd4567/resourceGroups/my-group/providers/Microsoft.KeyVault/vaults/my-key-vault

kubectl create secret generic secrets-store-credentials \
  --from-literal clientid=00000000-0000-0000-0000-000000000000 \
  --from-literal clientsecret=password \
  --namespace secrets-test

helm repo add csi-secrets-store-provider-azure https://raw.githubusercontent.com/Azure/secrets-store-csi-driver-provider-azure/master/charts

helm install csi-secrets-store-provider-azure/csi-secrets-store-provider-azure --generate-name --namespace default 

$ kubectl get pods -l app=secrets-store-csi-driver --namespace default
NAME                                                              READY   STATUS    RESTARTS   AGE
csi-secrets-store-provider-azure-1599821990-secrets-store-lwpkc   3/3     Running   0          44h

$ kubectl get pods -l app=csi-secrets-store-provider-azure --namespace default
NAME                                                READY   STATUS    RESTARTS   AGE
csi-secrets-store-provider-azure-1599821990-4vs8q   1/1     Running   0          44h

# spc.yaml

apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
  name: my-spc
spec:
  provider: azure
  parameters:
    keyvaultName: my-key-vault
    tenantId: aaaaaaaa-12ab-34cd-56ef-bbbbbbbbbbbb # Key VaultのTenant ID。Azure Portal上ではDirectory IDと呼ばれている
    objects: |
      array:
        - |
          objectType: secret
          objectName: my-secret1 # Key Vaultに格納されているsecretの名前
          objectAlias: secret1   # Secrets storageにマウントする際のファイル名。省略可能
        - |
          objectType: secret
          objectName: my-secret2
          objectAlias: secret2
  secretObjects:
    - data:
        - key: SECRET1 # Kubernetes SecretsのKey名。今回は環境変数として使うので変数名にしている
          objectName: secret1 # ↑で指定したsecretのobjectNameまたはobjectAlias
        - key: SECRET2
          objectName: secret2
      secretName: my-secrets # 同期させたいKubernetesのSecret名
      type: Opaque

kubectl apply -f spc.yaml --namespace secrets-test

# pod.yaml

kind: Pod
apiVersion: v1
metadata:
  name: my-test-pod-with-secrets
spec:
  containers:
    - image: alpine
      name: alpine
      command: ['tail']
      args: ['-f', '/dev/null']
      envFrom:
        - secretRef:
            name: my-secrets
      # 今回は環境変数に埋め込みたいので、ファイルシステムへのマウント機能は不要だが、Kubernetes Secretsへの同期は
      # サブ機能であり、ボリュームマウント自体がSecrets Store for CSI Driverの本分なのでこの設定は必須である
      volumeMounts:
        - name: secrets-store-inline
          mountPath: /mnt/secrets-store
          readOnly: true
  volumes:
    - name: secrets-store-inline
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: my-spc # さっき作ったSecretProviderClass名
        nodePublishSecretRef:
          name: secrets-store-credentials # さっき作ったKubernetes Secret名

kubectl apply -f pod.yaml --namespace secrets-test

$ kubectl get pods --namespace secrets-test
NAME                       READY   STATUS    RESTARTS   AGE
my-test-pod-with-secrets   1/1     Running   0          12m

kubectl exec my-test-pod-with-secrets -it --namespace secrets-test -- sh

# env
(略)
SECRET1=Secret1!!!
SECRET2=Secret2!!!

# ls -l /mnt/secrets-store/
total 8
-rw-r--r--    1 root     root            10 Sep 14 03:17 secret1
-rw-r--r--    1 root     root            10 Sep 14 03:17 secret2

# cat /mnt/secrets-store/secret1
Secret1!!!
# cat /mnt/secrets-store/secret2
Secret2!!!

kubectl delete namespace secrets-test