Awesome

Delinea DevOps Secrets Vault Kubernetes Secret Injector and Syncer

The DSV Kubernetes Injector and Syncer are components for Kubernetes. The Mutating Webhook injects Secret data from the Delinea DevOps Secrets Vault (DSV) into Kubernetes Secrets, and a CronJob periodically synchronizes them. The webhook can run as a pod or a stand-alone service, and the cronjob can run inside or outside the cluster.

• dsv-injector: Intercepts CREATE Secret admissions and then mutates the Secret with data from DSV.
• dsv-syncer: The syncer scans the cluster (or a single namespace) for Secrets that were mutated, compares the secret version, and updates if the secret has changed versions.

The common configuration consists of one or more Client Credential Tenant mappings. The credentials are then specified in an Annotation on the Kubernetes Secret to be mutated.

The webhook and syncer use the Golang SDK to communicate with the DSV API. They were tested with Docker Desktop and Minikube. They also work on OpenShift, Microk8s and others.

Contents

• Delinea DevOps Secrets Vault Kubernetes Secret Injector and Syncer
  • Contents
  • Supporting Docs
  • Injector & Syncer Differences
    • Which Should I Use?
  • Quick Start
    • Build
  • Test
  • Reference Mage Tasks
  • Contributors

Supporting Docs

The docs directory has supporting documentation that goes into more detail on the developer workflows, test setup, configuration, helm install commands, and more.

Injector & Syncer Differences

• Injector: This is a mutating webhook using AdmissionController. This means it operates on the CREATE of a Secret, and ensures it modified before finishing the creation of the resource in Kubernetes. This only runs on the creation action triggered by the server.
• Syncer: In contrast, the syncer is a normal cronjob operating on a schedule, checking for any variance in the data between the Secret data between the resource in Kubernetes and the expected value from DSV.

Which Should I Use?

• Both: If you want a secret to be injected on creation and also synced on your cron schedule then use the Injector and Syncer.
• Injector: If you want the secret to be static despite the change upstream in DSV, and will recreate the secret on any need to upgrade, then the injector. This will reduce the API calls to DSV as well.
• Syncer: If you want the secret value to be updated within the targeted schedule automatically. If this is run by itself without the injector, there can be a lag of up to a minute before the syncer will update the secret. Your application should be able to handle retrying the load of the credential to avoid using the cached credential value that might have been loaded on app start-up in this case.

Quick Start

Since there's a mix of users for this repo, here's where to go for getting up and running as quickly as possible.

Build

To build run: mage init build. For more detailed directions on local development (such as Mage), see setup-developer

Test

See details in local-testing

Reference Mage Tasks

Manually updated, for most recent Mage tasks, run mage -l.

Contributors

Thanks goes to these wonderful people (emoji key):

This project follows the all-contributors specification. Contributions of any kind welcome!