The Challenge of Scaling Secret Management in Kubernetes
Platform teams managing Kubernetes at scale quickly discover a significant security gap: reliably controlling secrets across clusters without hindering developer velocity. While Red Hat OpenShift improves upon vanilla Kubernetes, it inherits the same underlying limitations. Native Kubernetes Secrets, though useful, were not designed to meet enterprise governance requirements—especially as environments expand across multiple clusters and clouds.
The critical question shifts from “How do I get a secret into my pod?” to “How do I manage the entire lifecycle: generation, injection, rotation, and revocation—without slowing down development?” As hybrid-cloud adoption grows, a centralized, platform-agnostic solution becomes essential. HashiCorp Vault has emerged as the enterprise standard for secrets management, even in Kubernetes and OpenShift ecosystems. However, multiple integration patterns exist, each with different operational and security trade-offs, making it challenging to choose the right approach.
This article demystifies the available methods for integrating Vault with Kubernetes or OpenShift for automated secret lifecycle management, and explains why the Vault Secrets Operator (VSO) is now the recommended standard for most enterprise use cases—without forcing you to change how your pods interact with secrets.
Existing Integration Patterns at a Glance
Before diving into VSO, it’s worthwhile to understand the landscape of Vault-Kubernetes integrations. The main options include:
- Vault Secrets Operator (VSO) – a Kubernetes-native operator that syncs secrets from Vault to Kubernetes Secrets or directly to pods via CSI.
- VSO Protected Secrets – a variant that uses a built-in CSI companion driver for added security.
- Secrets Store CSI Driver (SSCSI) – a generic CSI driver that can mount secrets from various stores, including Vault.
- Vault Sidecar Agent Injector – a mutating webhook that injects a Vault agent sidecar into pods.
- Third-party secrets operators – other community operators that connect to Vault.
Historically, many teams defaulted to the Vault agent sidecar injector because it was the first robust solution. However, as the partnership between HashiCorp and Red Hat (via IBM) deepened, a more Kubernetes-native approach emerged: Vault Secrets Operator (VSO).
Vault Secrets Operator (VSO): The Modern Standard
VSO is a Kubernetes operator that runs as a controller in your cluster. It watches custom resources (CRDs) that define which secrets to fetch from Vault and how to sync them into Kubernetes Secrets or mount them directly into pods via CSI volumes. This approach offers several advantages:
- Native integration – VSO uses the Kubernetes API to manage secrets, making it feel like an extension of your cluster.
- Lifecycle automation – Secrets are automatically rotated as policies change in Vault, with no need for sidecar restarts.
- Reduced resource overhead – No additional agent or sidecar per pod compared to the injector pattern.
- Secure defaults – Secrets are never stored in plain text in the operator’s memory; VSO uses Vault tokens scoped to specific policies.
VSO is now the recommended integration for most enterprises, especially when paired with VSO Protected Secrets (which adds encryption and audit through the CSI driver).
VSO Protected Secrets: Enhanced Security with CSI
For environments requiring stringent security, VSO can be combined with the Secrets Store CSI Driver acting as a companion. This pattern ensures that secrets are never written to disk inside the pod—only mounted when the pod starts and automatically unmounted after rotation. This is ideal for regulated industries.
Secrets Store CSI Driver (SSCSI) – A Generic Alternative
The Secrets Store CSI Driver is a generic driver that supports multiple secret stores (Azure Key Vault, AWS Secrets Manager, GCP Secret Manager, etc.) in addition to Vault. It allows pods to mount secrets as CSI volumes. For Vault specifically, it requires a Vault provider component. While versatile, it lacks the deep integration and lifecycle management features that VSO offers. It is best suited for multi-provider environments where you need a single driver approach.
Vault Agent Sidecar Injector: The Legacy Approach
The Vault sidecar agent injector works by adding a small Vault agent sidecar container to each pod that needs secrets. The agent authenticates with Vault, retrieves secrets, and writes them to a shared volume. This was the go-to method before VSO, but it has trade-offs:
- Resource consumption – Each pod gets an extra container, increasing cluster overhead.
- Cold start latency – The sidecar must authenticate and fetch secrets before the pod’s main container runs.
- Less Kubernetes-native – It relies on a mutating webhook and sidecar pattern.
While still supported, most new deployments should consider VSO instead.
Third-Party Secrets Operators
Several third-party operators (e.g., External Secrets Operator) can also pull secrets from Vault. They often provide a similar CRD-based experience but may not offer the same level of lifecycle automation, security features, or direct support from HashiCorp. These are best when you need a provider-agnostic solution across multiple backends.
Choosing the Right Pattern for Your Enterprise
When evaluating which approach to use, consider these factors:
- Lifecycle automation needs – If you require automatic rotation with minimal downtime, VSO is the strongest candidate.
- Resource constraints – VSO reduces per-pod overhead compared to sidecars.
- Security requirements – VSO Protected Secrets with CSI provides the highest assurance.
- Existing investments – If you already use multiple secret stores, SSCSI or third-party operators may be pragmatic.
For most enterprises running Kubernetes or OpenShift, VSO represents the future of secret management. It combines the best of Kubernetes-native design with the robust governance that Vault provides, simplifying operations while maintaining security.
Conclusion
Managing secrets at enterprise scale demands a solution that is both secure and operationally efficient. The Vault Secrets Operator addresses this need by offering automated lifecycle management, minimal overhead, and tight integration with Kubernetes. Whether you choose VSO alone or enhanced with the CSI driver, you can move beyond the limitations of native Kubernetes Secrets and legacy sidecar patterns.
By understanding the trade-offs of each integration method, platform teams can make informed decisions that keep development fast and security tight.