EEdukron DevOps Library
SecurityAdvanced9 submodules

Key Vault Integration and Secret Rotation

Deliver secrets, keys, and certificates to pipelines and AKS workloads through identity-based Key Vault access with rotation and auditability.

How this module works

From concept to production evidence

Prefer managed or federated workload identity, grant data-plane access to the exact material required, retrieve at runtime, cache only when justified, monitor access, and rotate without changing source code.

Learning outcomes

  • Distinguish secrets, keys, and certificates
  • Compare access policies and Azure RBAC
  • Use managed identity for retrieval
  • Integrate pipelines and AKS
  • Design rotation and audit process

Flow diagram

Key Vault Integration and Secret Rotation end-to-end flow

Use this sequence as the operating backbone for every submodule note and hands-on exercise.

  1. 01
    Authenticate workloadKey Vault Integration and Secret Rotation stage 1: authenticate workload with an auditable result before the next stage begins.
  2. 02
    Authorize vault actionKey Vault Integration and Secret Rotation stage 2: authorize vault action with an auditable result before the next stage begins.
  3. 03
    Retrieve versioned materialKey Vault Integration and Secret Rotation stage 3: retrieve versioned material with an auditable result before the next stage begins.
  4. 04
    Use without disclosureKey Vault Integration and Secret Rotation stage 4: use without disclosure with an auditable result before the next stage begins.
  5. 05
    Audit accessKey Vault Integration and Secret Rotation stage 5: audit access with an auditable result before the next stage begins.
  6. 06
    Rotate and verifyKey Vault Integration and Secret Rotation stage 6: rotate and verify with an auditable result before the next stage begins.

Integrated hands-on lab

Remove static credentials from delivery

  1. Create Key Vault material
  2. Assign managed or federated identity
  3. Integrate Azure Pipeline retrieval
  4. Mount or inject material into AKS
  5. Rotate and verify uninterrupted access

Complete module contents

9 full submodule notes

Read in order
01

Secrets

Secrets controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Key Vault Integration and Secret Rotation. It is not an isolated definition: its value appears when it supports prefer managed or federated workload identity, grant data-plane access to the exact material required, retrieve at runtime, cache only when justified, monitor access, and rotate without changing source code.

Open full notes
02

Keys

Keys controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Key Vault Integration and Secret Rotation. It is not an isolated definition: its value appears when it supports prefer managed or federated workload identity, grant data-plane access to the exact material required, retrieve at runtime, cache only when justified, monitor access, and rotate without changing source code.

Open full notes
03

Certificates

Certificates controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Key Vault Integration and Secret Rotation. It is not an isolated definition: its value appears when it supports prefer managed or federated workload identity, grant data-plane access to the exact material required, retrieve at runtime, cache only when justified, monitor access, and rotate without changing source code.

Open full notes
04

Access policies

Access policies provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Key Vault Integration and Secret Rotation. It is not an isolated definition: its value appears when it supports prefer managed or federated workload identity, grant data-plane access to the exact material required, retrieve at runtime, cache only when justified, monitor access, and rotate without changing source code.

Open full notes
05

RBAC

RBAC controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Key Vault Integration and Secret Rotation. It is not an isolated definition: its value appears when it supports prefer managed or federated workload identity, grant data-plane access to the exact material required, retrieve at runtime, cache only when justified, monitor access, and rotate without changing source code.

Open full notes
06

Managed Identity

Managed Identity controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Key Vault Integration and Secret Rotation. It is not an isolated definition: its value appears when it supports prefer managed or federated workload identity, grant data-plane access to the exact material required, retrieve at runtime, cache only when justified, monitor access, and rotate without changing source code.

Open full notes
07

Pipeline integration

Pipeline integration governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Key Vault Integration and Secret Rotation. It is not an isolated definition: its value appears when it supports prefer managed or federated workload identity, grant data-plane access to the exact material required, retrieve at runtime, cache only when justified, monitor access, and rotate without changing source code.

Open full notes
08

AKS integration

AKS integration provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Key Vault Integration and Secret Rotation. It is not an isolated definition: its value appears when it supports prefer managed or federated workload identity, grant data-plane access to the exact material required, retrieve at runtime, cache only when justified, monitor access, and rotate without changing source code.

Open full notes
09

Secret rotation

Secret rotation controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Key Vault Integration and Secret Rotation. It is not an isolated definition: its value appears when it supports prefer managed or federated workload identity, grant data-plane access to the exact material required, retrieve at runtime, cache only when justified, monitor access, and rotate without changing source code.

Open full notes