<p>I've recently started using KOPS as a tool to provision Kubernetes clusters and from what I've seen so far, it stores it's CA key and certificates in its S3 bucket, which is fine.</p>
<p>But out curiosity, would it be possible to store these in Hashicorp Vault instead, as opposed to s3?</p>

<blockquote>
<p>But out curiosity, would it be possible to store these in Hashicorp Vault instead, as opposed to s3?</p>
</blockquote>
<p>Yes. User <a href="https://stackoverflow.com/users/5343387/matt-schuchard" title="16,592 reputation">Matt Schuchard</a> has mentioned in the comment:</p>
<blockquote>
<p>Yes you can store them in the KV2 secrets engine, or use the PKI secrets engine to generate them instead.</p>
</blockquote>
<p>For more details look at this <a href="https://kops.sigs.k8s.io/state/" rel="nofollow noreferrer">kops documentation</a>. The most interesting part should be <a href="https://kops.sigs.k8s.io/state/#node-authentication-and-configuration" rel="nofollow noreferrer">Node authentication and configuration</a>:</p>
<blockquote>
<p>The vault store uses IAM auth to authenticate against the vault server and expects the vault auth plugin to be mounted on  <code>/aws</code>.</p>
<p>Instructions for configuring your vault server to accept IAM authentication are at <a href="https://learn.hashicorp.com/vault/identity-access-management/iam-authentication" rel="nofollow noreferrer">https://learn.hashicorp.com/vault/identity-access-management/iam-authentication</a></p>
<p>To configure kOps to use the Vault store, add this to the cluster spec:</p>
</blockquote>
<pre><code>spec:
  secretStore: vault://&lt;vault&gt;:&lt;port&gt;/&lt;kv2 mount&gt;/clusters/&lt;clustername&gt;/secrets
  keyStore: vault://&lt;vault&gt;:&lt;port&gt;/&lt;kv2 mount&gt;/clusters/&lt;clustername&gt;/keys
</code></pre>
<p>Look also at this <a href="https://learn.hashicorp.com/tutorials/vault/approle" rel="nofollow noreferrer">hashicorp site</a>.</p>
