~/ nmadiraju.com Amazon EKS · Secrets from AWS
arrow_back Back to nmadiraju
Visual Walkthrough · Kubernetes configuration

How Secrets from AWS Work on Amazon EKS

Follow checkout's database password from Git into AWS Secrets Manager and back into its Pod, then check yourself with 8 questions.

1Visual Walkthrough

An EKS cluster reading checkout's database password from AWS Secrets Manager through External Secrets Operator or the Secrets Store CSI driver GitHub and repo readers sit on the left. The EKS cluster prod-east holds a cluster-scoped ClusterSecretStore, and a Secret, an ExternalSecret or a SecretProviderClass in namespace shop, and node-1 runs checkout's Pod, the external-secrets controller and the Secrets Store CSI driver with the AWS provider. On the right, the AWS account holds Secrets Manager, a KMS key, IAM roles and EKS Pod Identity associations. The walkthrough moves the password out of Git, syncs it with External Secrets, shows the env var rotation gotcha, mounts it with the CSI driver, enables rotation, and narrows IAM to one secret. GitHub repo readers 40 people + CI logs, forks EKS CLUSTER prod-east KUBERNETES API · ns shop Secret checkout-db type: Opaque ClusterSecretStore aws-sm SecretsManager us-east-1 cluster-scoped · no auth SecretProviderClass checkout-db provider: aws usePodIdentity path password → db-password ExternalSecret → Secret checkout-db prod/checkout/db property: password refreshInterval: 1h node-1 · EC2 sa checkout checkout container environment variable CSI volume at /mnt/secrets external-secrets controller Pod sa external-secrets Secrets Store CSI driver + AWS provider (ASCP), DaemonSets in kube-system AWS · 111122223333 · us-east-1 AWS Secrets Manager prod/checkout/db prod/payments/stripe + 212 more secrets KMS key checkout-cmk customer managed · encrypts prod/checkout/db IAM role EKS Pod Identity associations

    2Quiz to check understanding

    Check yourself