Produk yang dijelaskan dalam dokumentasi ini, Cluster Anthos di AWS (generasi sebelumnya), kini berada dalam mode pemeliharaan. Semua penginstalan baru harus menggunakan produk generasi saat ini, cluster Anthos di AWS.
Anda dapat mengakses secret Vault di dalam pod menggunakan injektor Agent Sidecar. Injector adalah
Pengontrol Webhook Mutasi Kubernetes.
Pengontrol mencegat peristiwa Pod dan memperbarui konfigurasi Pod.
Injector Agen Vault menggunakan Akun Layanan Kubernetes (KSA) Pod dengan metode
Autentikasi Kubernetes Vault. Akun KSA harus terikat ke peran Vault dengan
kebijakan yang memberikan akses ke secret.
Setelah dikonfigurasi, Anda dapat meminta secret dengan memberikan anotasi pada Pod.
Cuplikan berikut menyertakan anotasi yang akan Anda tambahkan ke Pod.
Jika peran myapp memiliki akses ke Secret secret/banana, Vault akan memasangnya di /vault/secrets/apple.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-07-14 UTC."],[],[],null,["# Using HashiCorp Vault on GKE on AWS\n\n[HashiCorp Vault](https://www.vaultproject.io/) is a third-party\nsecrets management solution that integrates with Kubernetes and\nGKE on AWS.\n| **Note:** This section is not meant as an endorsement or recommendation to use HashiCorp Vault.\n\nYou can deploy Vault on GKE on AWS using:\n\n- HashiCorp's official [Helm chart](https://www.vaultproject.io/docs/platform/k8s/helm/)\n- [Vault on GKE](https://github.com/sethvargo/vault-on-gke), which is installed with Terraform.\n\nYou can access Vault secrets inside pods using the Agent Sidecar injector. The\ninjector is a\n[Kubernetes Mutating Webhook Controller](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/).\nThe controller intercepts Pod events and updates the Pod's configuration.\n\nThe Vault Agent Injector uses a Pod's Kubernetes Service Account (KSA) with the\nVault Kubernetes Auth method. The KSA account must be bound to a Vault role with\na policy granting access to the secrets.\n\nOnce configured, you can request secrets by annotating a Pod.\n\nThe following snippet includes annotations that you would add to a Pod.\nIf the `myapp` role has access to Secret `secret/banana`, Vault\nmounts it at `/vault/secrets/apple`. \n\n spec:\n template:\n metadata:\n annotations:\n vault.hashicorp.com/agent-inject: \"true\"\n vault.hashicorp.com/agent-inject-secret-apple: \"secrets/banana\"\n vault.hashicorp.com/role: \"myapp\"\n\nYou can apply this configuration:\n\n- To a Pod with `kubectl edit pod/`\u003cvar translate=\"no\"\u003epod-name\u003c/var\u003e.\n- To a Deployment with `kubectl edit deployment/`\u003cvar translate=\"no\"\u003edeployment-name\u003c/var\u003e.\n\nWhat's next\n-----------\n\n- Read the [Vault Injector](https://www.vaultproject.io/docs/platform/k8s/injector/) documentation.\n- Review the [vault-k8s GitHub repository](https://github.com/hashicorp/vault-k8s)."]]
