Format:
Export:

Architecture & setup diagrams

THREE WAYS A SECRET REACHES YOUR POD OpenBao KV v2 / database engine secret/myapp/config database/creds/… ① External Secrets Operator ( INT-001 ) SecretStore + ExternalSecret k8s auth · CA bundle · refreshInterval Kubernetes Secret myapp-secrets (synced) ② Secrets Store CSI driver ( INT-002 ) SecretProviderClass provider DaemonSet (privileged SCC) CSI volume in pod /mnt/secrets/* (+ synced Secret) ③ Agent injector ( INT-003 · UC-002 ) pod annotations webhook injects init + sidecar vault-agent sidecar renders /vault/secrets/* renews leases App pod ns myapp · SA myapp-sa env / volume ← Secret /mnt/secrets/* /vault/secrets/* ① creates a real K8s Secret — best for GitOps/env-var apps · updates on refreshInterval (or force-sync annotation) ② files only, no Secret required (optional sync) — updates on pod (re)mount · ③ no Secret at all, agent renews dynamic creds live — best for DB credentials (UC-002)

Search test plan

Type at least 2 characters to search

↑ ↓ navigate↵ openEsc close

Keyboard shortcuts

P
Go to prerequisites
T
Go to test cases
G
Go to glossary
D
Go to diagrams
J
Next card
K
Previous card
Enter
Open / close focused card
/
Open search
⌘CtrlK
Open search modal
?
Show shortcuts
Esc
Close panel / blur search