At Canva we implemented dynamic secrets management using HashiCorp Vault to improve our security posture and automate secret rotation. However, migrating 3rd party applications that we have no ownership or code control over presented a challenge. This session will dive into how Canva implemented dynamic secrets in Kubernetes, with Datadog as an example. We'll look at the Vault CSI Provider and Vault Agent Injector, and explain how the Vault Secrets Operator unlocked a zero code change migration.