<p>I have two kubernetes clusters running on Azure AKS.</p>
<ul>
<li>One cluster named APP-Cluster which is hosting application pods.</li>
<li>One cluster named Vault-Cluster which the Hashicorp Vault is installed on.</li>
</ul>
<p>I have installed Hashicorp Vault with Consul in HA mode according to below official document. The installation is successful.</p>
<p><a href="https://learn.hashicorp.com/tutorials/vault/kubernetes-minikube?in=vault/kubernetes" rel="nofollow noreferrer">https://learn.hashicorp.com/tutorials/vault/kubernetes-minikube?in=vault/kubernetes</a></p>
<p>But I am quite lost on how to connect and retrieve the secrets in Vault cluster from another cluster. I would like to use the sidecar injection method of Vault for my app cluster to communicate with vault cluster. I tried the follow the steps in below official document but in the document minikube is used instead of public cloud Kubernetes Service. How do I define the  &quot;EXTERNAL_VAULT_ADDR&quot; variable for AKS like described in the document for minikube? Is it the api server DNS address which I can get from Azure portal?</p>
<p><a href="https://learn.hashicorp.com/tutorials/vault/kubernetes-external-vault?in=vault/kubernetes" rel="nofollow noreferrer">https://learn.hashicorp.com/tutorials/vault/kubernetes-external-vault?in=vault/kubernetes</a></p>

<p>The way you interact with <code>Vault</code> is via HTTP(s) API. That means you need to expose the <code>vault</code> service running in your <code>Vault-Cluster</code> cluster using one of the usual methods.</p>
<p>As an example you could:</p>
<ul>
<li>use a service of type <a href="https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer" rel="nofollow noreferrer"><code>LoadBalancer</code></a> (this works because you are running kubernetes in a cloud provider that supports this feature);</li>
<li>install an <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">ingress controller</a>, expose it (again with a load balancer) and define an <code>Ingress</code> resource for your <code>vault</code> service.</li>
<li>use a <a href="https://kubernetes.io/docs/concepts/services-networking/service/#nodeport" rel="nofollow noreferrer">node port</a> service</li>
</ul>
<p>The <code>EXTERNAL_VAULT_ADDR</code> value depends on which strategy you want to use.</p>
