# ECK - Alternative secrets storage using CSI Driver for KeyVault in Azure

**URL:** <https://discuss.elastic.co/t/eck-alternative-secrets-storage-using-csi-driver-for-keyvault-in-azure/284294>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Created:** [September 15, 2021, 2:11pm UTC](https://discuss.elastic.co/t/eck-alternative-secrets-storage-using-csi-driver-for-keyvault-in-azure/284294 "2021-09-15T14:11:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![x00m](https://avatars.discourse-cdn.com/v4/letter/x/90db22/32.png) [@x00m](https://discuss.elastic.co/u/x00m)\
**Post date:** [September 15, 2021, 2:11pm UTC](https://discuss.elastic.co/t/eck-alternative-secrets-storage-using-csi-driver-for-keyvault-in-azure/284294/1 "2021-09-15T14:11:53Z")

</div>

I have integrated my AKS cluster with Azure Keyvault CSI Driver for secrets storage.

Link:  
[GitHub - Azure/secrets-store-csi-driver-provider-azure: Azure Key Vault provider for Secret Store CSI driver allows you to get secret contents stored in Azure Key Vault instance and use the Secret Store CSI driver interface to mount them into Kubernetes pods.](https://github.com/Azure/secrets-store-csi-driver-provider-azure)

Now, after I have configured this (volume mounts in the elasticSearch yaml specs), the creation of a new ElasticSearch resource still creates the secrets (eg elastic username/pass) in the k8s secrets in plaintext (base64 encoded) and not the keyvault

How can I make elastic use the Azure Keyvault CSI driver to store secrets and not the default k8s secrets?

---

<div class="post-metadata">

**Author:** ![Thibault\_Richard](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thibault_richard/32/50513_2.png) [@Thibault\_Richard](https://discuss.elastic.co/u/Thibault_Richard)\
**Post date:** [September 15, 2021, 2:49pm UTC](https://discuss.elastic.co/t/eck-alternative-secrets-storage-using-csi-driver-for-keyvault-in-azure/284294/2 "2021-09-15T14:49:09Z")

</div>

> How can I make elastic use the Azure Keyvault CSI driver to store secrets and not the default k8s secrets?

As far as I understand, Azure Keyvault CSI driver doesn't allow to write secret from Kubernetes to the Azure Key Vault instance. It only works the other way around, secrets are retrieved from Vault and then can be used in Kubernetes.

Also, I'm not sure how it is relevant for internal secrets managed by the operator to be stored in Azure Keyvault. This seems more relevant for secrets you provide to your cluster such as secrets to [define users and roles](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-users-and-roles.html#k8s_file_realm). In that case, you might be interested in [syncing mounted content with Kubernetes secret](https://azure.github.io/secrets-store-csi-driver-provider-azure/configurations/sync-with-k8s-secrets/).

---

<div class="post-metadata">

**Author:** ![x00m](https://avatars.discourse-cdn.com/v4/letter/x/90db22/32.png) [@x00m](https://discuss.elastic.co/u/x00m)\
**Post date:** [September 23, 2021, 6:18am UTC](https://discuss.elastic.co/t/eck-alternative-secrets-storage-using-csi-driver-for-keyvault-in-azure/284294/3 "2021-09-23T06:18:01Z")

</div>

Thanks for the response.  
Here is a bit more detail:

There are secrets "created" by the eck setup as follows:-

namespace: elastic-system  
**Secrets:**

default-token-9q898  
elastic-operator-token-pnl5n  
elastic-webhook-server-cert

new "Elasticsearch" resource secrets -  
quickstart3-es-http-ca-internal  
quickstart3-es-http-certs-internal  
quickstart3-es-http-certs-public  
quickstart3-es-default-es-config  
quickstart3-es-default-es-transport-certs  
quickstart3-es-elastic-user  
quickstart3-es-internal-users  
quickstart3-es-remote-ca  
quickstart3-es-transport-ca-internal  
quickstart3-es-transport-certs-public  
quickstart3-es-xpack-file-realm  
eck0-quickstart3-kibana-user  
quickstart3-kb-es-ca  
quickstart3-kibana-user  
quickstart3-kb-http-ca-internal  
quickstart3-kb-config  
quickstart3-kb-http-certs-internal  
quickstart3-kb-http-certs-public

It is clear that the azure keyvault CSI drver can be used to only "read" secrets from the keyvault.  
However, the secrets I mentioned above are created by the eck instance installation.

Can these secrets be secured/encrypted in some way?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 21, 2021, 6:18am UTC](https://discuss.elastic.co/t/eck-alternative-secrets-storage-using-csi-driver-for-keyvault-in-azure/284294/4 "2021-10-21T06:18:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.