Using Azure Key Vault or Hashicorp Vault to store Apigee Hybrid secrets

[varunrajbhat]

We are currently using terraform for deploying Apigee Hybrid on AKS cluster. We create the service account keys as per the documentation:https://cloud.google.com/apigee/docs/hybrid/v1.4/2-5-install-service-accounts  and store the certs and keys in Azure vault . They are retrieved during the build time and are passed to the overrides.yaml file. This approach will require us to run the build pipeline to update the certs or keys. We wanted to use Azure Key Vault provider for Secrets Store CSI driver to get secret contents stored in an Azure Key Vault instance and use the Secrets Store CSI driver interface to mount them into Kubernetes pods. Can the Apigee Hybrid be configured to read secrets from vault during runtime?

Anyone who has access to the cluster can view the secrets. Is there a config change we can make to make it more secure ?

[Former Community Member]

Apigee hybrid does not support Kubernetes Secret Store CSI Drivers at the moment. Consider using a controller like External Secrets to provision Kubernetes secrets from Azure KV or Hashicorp Vault.   

Please use Kubernetes RBAC to ensure users do not have access to view Secrets