Azure Key Vault To Kubernetes
Project status: Stable - multipal financial institutions are running this project on production Kubernetes clusters
Read the announcement: https://mrdevops.io/introducing-azure-key-vault-to-kubernetes-931f82364354
Full documentation available at https://akv2k8s.io
Azure Key Vault to Kubernetes (akv2k8s) has two components for handling Azure Key Vault Secrets in Kubernetes:
- Azure Key Vault Controller
- Azure Key Vault Env Injector
The Azure Key Vault Controller (Controller for short) is for synchronizing Secrets, Certificates and Keys from Azure Key Vault to native
Secret's in Kubernetes.
The Azure Key Vault Env Injector (Env Injector for short) is a Kubernetes Mutating Webhook transparently injecting Azure Key Vault secrets as environment variables into programs running in containers, without touching disk or in any other way expose the actual secret content outside the program.
Goals for this project was:
- Avoid a direct program dependency on Azure Key Vault for getting secrets, and adhere to the 12 Factor App principle for configuration (https://12factor.net/config)
- Make it simple, secure and low risk to transfer Azure Key Vault secrets into Kubernetes as native Kubernetes secrets
- Securely and transparently be able to inject Azure Key Vault secrets as environment variables to applications, without having to use native Kubernetes secrets
All of these goals are met.
- Kubernetes version >= 1.9
- Enabled admission controllers: MutatingAdmissionWebhook and ValidatingAdmissionWebhook
- RBAC enabled
- Default authentication requires Kubernetes cluster running in Azure - use custom authentication if running outside Azure
It's recommended to use Helm charts for installation:
For more details, see full documentation at https://akv2k8s.io.
Installation without Helm
If Helm is not an option in Kubernetes, use Helm on a local computer to generate the Kubernetes templates like below:
helm install --debug --dry-run <options>
See the individual Helm charts above for
Development of Azure Key Vault for Kubernetes happens in the open on GitHub, and encourage users to:
- Send a pull request with any security issues found and fixed
- Send a pull request with your new features and bug fixes
- Report issues on security or other issues you have come across
- Help new users with issues they may encounter
- Support the development of this project and star this repo!
Sparebanken Vest has adopted a Code of Conduct that we expect project participants to adhere to. Please read the full text so that you can understand what actions will and will not be tolerated.
Azure Key Vault to Kubernetes is licensed under Apache License 2.0.