You are setting up the Secrets Provider for Kubernetes to support rotation with Push-to-File mode. Which deployment option should be used?

The sidecar deployment model is the correct option for supporting secret rotation with the Push-to-File mode. In this pattern, the CyberArk Secrets Provider runs in a separate container alongside the application container within the same Kubernetes pod. They share a memory volume (emptyDir). The sidecar container is a long-running process that authenticates to the vault, retrieves secrets, and writes them to the shared volume. It periodically checks for updated secret versions and automatically pushes the new value to the file, enabling seamless rotation without requiring an application restart.

A. Init container: An init container runs to completion before the main application container starts. It is suitable for fetching initial secrets but cannot handle ongoing rotation as it is not a persistent process.

B. Application container: Integrating the Secrets Provider directly into the application container is not the recommended pattern as it tightly couples the application with secrets management logic, violating the principle of separation of concerns.

D. Service Broker: A Service Broker is a component of the Open Service Broker API for provisioning services on a platform level. It is not a deployment pattern for an agent within an application pod.

1. CyberArk Official Documentation

"Secrets Provider for Kubernetes." In the section describing deployment patterns

it explicitly details the sidecar model for applications that require secrets to be available on the file system. It states

"The Secrets Provider for Kubernetes can run as a sidecar container in the application Pod. The Secrets Provider container and the application container mount a shared volume... The Secrets Provider retrieves secrets and writes them to the shared volume. The application can then read the secrets from the volume." This model is essential for the rotation feature.

2. CyberArk Official Documentation

"Secrets Provider for Kubernetes Configuration." The documentation on configuring secret rotation (cyberark.com/rotation/interval) is predicated on the Secrets Provider running as a continuous process

which is characteristic of the sidecar model

not an init container. The sidecar periodically checks for new secret versions based on this configuration.

3. CyberArk Official Documentation

"Deploy Secrets Provider for Kubernetes." The deployment examples for Push-to-File mode consistently show a pod specification with two containers: the application container and the cyberark-secrets-provider-for-k8s sidecar container

sharing an emptyDir volume. This confirms the sidecar as the required architecture.