<p>The kubernetes ingress controller is deployed in my AKS cluster. I am using the following ingress rules configuration for client certificate authentication.</p>
<p>tls-secret, ca-secret are the two secrets containing certificates required for authentication.</p>
<p>Now, my requirement is to get these certificates from Vault or Consul KV store and ingress rules should pick up these certificates from there.</p>
<ol>
<li><p>Is there a way nginx ingress rule picks up certificates in other form than kubernetes secrets?</p>
</li>
<li><p>If not, how do we convert vault secrets to kubernetes secrets. Is this a standard way of going about this?</p>
</li>
</ol>
<p>Ingress-rules.yaml</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
  meta.helm.sh/release-name: service
  meta.helm.sh/release-namespace: mynamespace
  nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: &quot;true&quot;
  nginx.ingress.kubernetes.io/auth-tls-secret: microservices/ca-secret
  nginx.ingress.kubernetes.io/auth-tls-verify-client: &quot;on&quot;
  nginx.ingress.kubernetes.io/auth-tls-verify-depth: &quot;3&quot;
  nginx.ingress.kubernetes.io/enable-underscores-in-headers: &quot;true&quot;
name: service-nginx-ingress
namespace: mynamespace
spec:
  ingressClassName: nginx
rules:
- host: ingress-nginx-controller.microservices.com
  http:
    paths:
    - backend:
        service:
          name: service
          port:
            number: 8080
      path: /api/v1/service
      pathType: Prefix
tls:
- hosts:
  - ingress-nginx-controller.microservices.com
  secretName: tls-secret
</code></pre>
<p>I tried getting certificates on a pod using vault agent, but couldn't create secrets in the cluster using that data from Vault.</p>

user1514910
<p>As @larks mentioned, you can use an <a href="https://github.com/external-secrets/external-secrets" rel="nofollow noreferrer">external secrets operator</a> to  pick up certificates in other forms than kubernetes secrets.</p>
<blockquote>
<p>The goal of External Secrets Operator is to synchronize secrets from external APIs into Kubernetes. ESO is a collection of custom API resources - ExternalSecret, SecretStore and ClusterSecretStore that provide a user-friendly abstraction for the external API that stores and manages the lifecycle of the secrets for you.</p>
</blockquote>
<p>External Secrets Operator allows the operator to retrieve secrets from a Kubernetes Cluster - this can be either a remote cluster or the local where the operator runs in. A SecretStore points to a specific namespace in the target Kubernetes Cluster.</p>
<p><strong>Note</strong>- The minimum supported version of Kubernetes is 1.16.0. Users still running Kubernetes v1.15 or below should upgrade to a supported version before installing external-secrets.</p>
