Answers: <p>As the Linux philosophy says:</p>
  <blockquote>
  <p>Make each program do one thing well</p>
  </blockquote>
  <p>So it's worth it to use the vault agent, cause it's doing well what it would be done.</p>
  <p>You can find an awesome example <a href="https://www.vaultproject.io/docs/platform/k8s/injector" rel="nofollow noreferrer" title="here">here</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2021-03-04T09:22:04.420Z
Answers: 2021-03-04T09:22:04.420Z
Answers: Hakob
Body: <p>I have Node JS app inside pods, which needs to read vault secrets.
  So far I found 2 methods for doing that</p>
  <ol>
  <li>Using init container to mount secrets as .txt files and read/parse them in my app</li>
  <li>Using node-vault connect to vault server directly and read secrets, which requires initial token</li>
  </ol>
  <p>For (1) I found <a href="https://blog.aquasec.com/managing-kubernetes-secrets" rel="nofollow noreferrer">this</a> article, where the author is considering it as not secure and complex.</p>
  <blockquote>
  <p>Secrets mounted as volumes are unwieldy—secrets can be stored as
  environment variables or mounted as a volume. The former technique is
  widely agreed to be less secure. If you opt for volumes, things
  quickly get complex when you have a large number of keys. Kubernetes
  creates one file per key, and you need to read all these files from
  within the application. There are workarounds, but they can be equally
  complex.</p>
  </blockquote>
  <p>For the (2) I am not sure how to automatically unseal and obtain initial tokens without using Amazon secrets or other services. Of course I can't hard code initial token or <code>roll_id/secret_id</code>. What is the typical way of obtaining and passing initial token to the pods?</p>
  
Comments: CC BY-SA 4.0
Comments: 2021-03-01T16:58:14.430Z
Comments: Same question thread at vendor's site: https://discuss.hashicorp.com/t/how-to-use-hashicorp-vault-with-nodejs-application/21468/6 @pablo please share with us if you know more.
Comments: Ta Mu
Tags: <kubernetes><hashicorp-vault>
Title: How to use Hashicorp Vault with NodeJS application?
UserDisplayName: Pablo
ThreadText: # How to use Hashicorp Vault with NodeJS application?
  
  (Asked by: username_0 on 2021-02-27)
  
  I have Node JS app inside pods, which needs to read vault secrets.
  So far I found 2 methods for doing that
  
  1. Using init container to mount secrets as .txt files and read/parse them in my app
  2. Using node-vault connect to vault server directly and read secrets, which requires initial token
  
  For (1) I found [this](https://blog.aquasec.com/managing-kubernetes-secrets) article, where the author is considering it as not secure and complex.
  
  > Secrets mounted as volumes are unwieldy—secrets can be stored as
  > environment variables or mounted as a volume. The former technique is
  > widely agreed to be less secure. If you opt for volumes, things
  > quickly get complex when you have a large number of keys. Kubernetes
  > creates one file per key, and you need to read all these files from
  > within the application. There are workarounds, but they can be equally
  > complex.
  
  For the (2) I am not sure how to automatically unseal and obtain initial tokens without using Amazon secrets or other services. Of course I can't hard code initial token or `roll_id/secret_id`. What is the typical way of obtaining and passing initial token to the pods?
  
  **Tags:** kubernetes, hashicorp-vault
  
  > **Comments:**
  > **username_1**: Same question thread at vendor's site: https://discuss.hashicorp.com/t/how-to-use-hashicorp-vault-with-nodejs-application/21468/6 @username_0 please share with us if you know more.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2021-03-04. Score: 1
  
  As the Linux philosophy says:
  
  > Make each program do one thing well
  
  So it's worth it to use the vault agent, cause it's doing well what it would be done.
  
  You can find an awesome example [here](https://www.vaultproject.io/docs/platform/k8s/injector "here")
  
  
  ---
  
  