<p>As the Linux philosophy says:</p>
<blockquote>
<p>Make each program do one thing well</p>
</blockquote>
<p>So it's worth it to use the vault agent, cause it's doing well what it would be done.</p>
<p>You can find an awesome example <a href="https://www.vaultproject.io/docs/platform/k8s/injector" rel="nofollow noreferrer" title="here">here</a></p>

CC BY-SA 4.0
2021-03-04T09:22:04.420Z
2021-03-04T09:22:04.420Z
Hakob
<p>I have Node JS app inside pods, which needs to read vault secrets.
So far I found 2 methods for doing that</p>
<ol>
<li>Using init container to mount secrets as .txt files and read/parse them in my app</li>
<li>Using node-vault connect to vault server directly and read secrets, which requires initial token</li>
</ol>
<p>For (1) I found <a href="https://blog.aquasec.com/managing-kubernetes-secrets" rel="nofollow noreferrer">this</a> article, where the author is considering it as not secure and complex.</p>
<blockquote>
<p>Secrets mounted as volumes are unwieldy—secrets can be stored as
environment variables or mounted as a volume. The former technique is
widely agreed to be less secure. If you opt for volumes, things
quickly get complex when you have a large number of keys. Kubernetes
creates one file per key, and you need to read all these files from
within the application. There are workarounds, but they can be equally
complex.</p>
</blockquote>
<p>For the (2) I am not sure how to automatically unseal and obtain initial tokens without using Amazon secrets or other services. Of course I can't hard code initial token or <code>roll_id/secret_id</code>. What is the typical way of obtaining and passing initial token to the pods?</p>

CC BY-SA 4.0
2021-03-01T16:58:14.430Z
Same question thread at vendor's site: https://discuss.hashicorp.com/t/how-to-use-hashicorp-vault-with-nodejs-application/21468/6 @pablo please share with us if you know more.
Ta Mu
<kubernetes><hashicorp-vault>
How to use Hashicorp Vault with NodeJS application?
Pablo
# How to use Hashicorp Vault with NodeJS application?

(Asked by: username_0 on 2021-02-27)

I have Node JS app inside pods, which needs to read vault secrets.
So far I found 2 methods for doing that

1. Using init container to mount secrets as .txt files and read/parse them in my app
2. Using node-vault connect to vault server directly and read secrets, which requires initial token

For (1) I found [this](https://blog.aquasec.com/managing-kubernetes-secrets) article, where the author is considering it as not secure and complex.

> Secrets mounted as volumes are unwieldy—secrets can be stored as
> environment variables or mounted as a volume. The former technique is
> widely agreed to be less secure. If you opt for volumes, things
> quickly get complex when you have a large number of keys. Kubernetes
> creates one file per key, and you need to read all these files from
> within the application. There are workarounds, but they can be equally
> complex.

For the (2) I am not sure how to automatically unseal and obtain initial tokens without using Amazon secrets or other services. Of course I can't hard code initial token or `roll_id/secret_id`. What is the typical way of obtaining and passing initial token to the pods?

**Tags:** kubernetes, hashicorp-vault

> **Comments:**
> **username_1**: Same question thread at vendor's site: https://discuss.hashicorp.com/t/how-to-use-hashicorp-vault-with-nodejs-application/21468/6 @pablo please share with us if you know more.  

---

## 1 answers

### Answer by username_2 on 2021-03-04. Score: 1

As the Linux philosophy says:

> Make each program do one thing well

So it's worth it to use the vault agent, cause it's doing well what it would be done.

You can find an awesome example [here](https://www.vaultproject.io/docs/platform/k8s/injector "here")


---

