<p>I hope somebody can help me out here.</p>
<p>I have a basic configuration in azure which consists in a web app and database.</p>
<p>The web app is able to connect to the database using managed identity adn everything here works just fine, but i wanted to try the same configuration using aks.</p>
<p>I deployed AKS and enabled managed identity. I deployed a pod into the cluster as follow:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: webapp-deployment
  labels:
    app: webapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webapp
  template:
    metadata:
      labels:
        app: webapp
    spec:
      containers:
        - name: webapp
          image: dockerimage
          ports:
            - containerPort: 80
          env:
            - name: &quot;ConnectionStrings__MyDbConnection&quot;
              value: &quot;Server=server-url; Authentication=Active Directory Managed Identity; Database=database-name&quot;
            - name: &quot;ASPNETCORE_ENVIRONMENT&quot;
              value: &quot;Development&quot;
          securityContext:
            allowPrivilegeEscalation: false
      restartPolicy: Always 
</code></pre>
<p>The deployment went trough just smoothly and everything works just fine. But this is where i have the problem and cannot figure out the best solution.</p>
<p>The env block is in plain text, i would like to protect those environment variables by storing them in a keyvault.</p>
<p>I have been looking around into different forums and documentation and the options start confusing me. Is there any good way to achieve security in this scenario?</p>
<p>In my web app, under configurations i have the managed identity enabled and using this i can access the secrets in a keyvault and retrieve them. Can i do the same using AKS?</p>
<p>Thank you so much for any help you can provide or help with.</p>
<p>And please if my question is not 100% clear, just let me know</p>

Nayden Van
<ol>
<li><a href="https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver#upgrade-an-existing-aks-cluster-with-azure-key-vault-provider-for-secrets-store-csi-driver-support" rel="nofollow noreferrer">Upgrade an existing AKS cluster with Azure Key Vault Provider for Secrets Store CSI Driver support</a></li>
<li><a href="https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-identity-access#use-a-user-assigned-managed-identity" rel="nofollow noreferrer">Use a user-assigned managed identity to access KV</a></li>
<li><a href="https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver#set-an-environment-variable-to-reference-kubernetes-secrets" rel="nofollow noreferrer">Set an environment variable to reference Kubernetes secrets</a></li>
</ol>
<p>You will need to do some reading, but the process is straight forward.
The KV secrets will be stored in k8s secrets, that you can reference in the pods environment variables.</p>
