[Sandbox] Bank-Vaults

[sagikazarmark]

Application contact emails

mark.sagikazar@gmail.com, team@bank-vaults.dev, ospo@cisco.com

Project Summary

Bank-Vaults is a set of tools covering many aspects of secret management in the Cloud Native ecosystem.

Project Description

Bank-Vaults is an umbrella project for Cloud Native secret management tools:

• Bank-Vaults CLI to make configuring Hashicorp Vault easier
• Vault operator to make operating Hashicorp Vault on top of Kubernetes easier
• Vault secrets webhook to inject secrets directly into Kubernetes pods
• Vault SDK to make working with Vault easier in Go
• and others

Bank-Vaults aims to help developers and SREs alike by covering the entire secret management pipeline from operating a secret store to injecting and using secrets in applications.

Org repo URL (provide if all repos under the org are in scope of the application)

https://github.com/bank-vaults

Project repo URL in scope of application

https://github.com/bank-vaults/bank-vaults

Additional repos in scope of the application

https://github.com/bank-vaults/vault-operator
https://github.com/bank-vaults/vault-secrets-webhook
https://github.com/bank-vaults/vault-sdk
https://github.com/bank-vaults/vault-helm-chart

Website URL

https://bank-vaults.dev

Roadmap

Roadmap

Roadmap context

The roadmap is still being defined. We are talking to users to figure out their needs and prioritize new features. We already have a number of items on the roadmap, but most of the effort is still going into the project migration from the banzaicloud GitHub organization.

One important goal for the near future is to broaden the scope of the project and add support for other secret management solutions than Hashicorp’s Vault.

Contributing Guide

https://bank-vaults.dev/docs/contributing/

Code of Conduct (CoC)

https://bank-vaults.dev/docs/code-of-conduct/

Adopters

https://github.com/bank-vaults/bank-vaults/blob/main/ADOPTERS.md

Contributing or Sponsoring Org

https://opensource.cisco.com

Maintainers file

https://github.com/bank-vaults/bank-vaults/blob/main/MAINTAINERS.md

IP Policy

• If the project is accepted, I agree the project will follow the CNCF IP Policy

Trademark and accounts

• If the project is accepted, I agree to donate all project trademarks and accounts to the CNCF

Why CNCF?

The CNCF hosts a vibrant and diverse community of developers and organizations. Contributing to this ecosystem allows the Bank-Vaults to attract more contributors, leading to better and faster improvements. Furthermore, the CNCF is able to provide a vendor neutral home for the project, allowing for collaboration among various vendors, fostering the creation of a solution that delivers collective benefits to all stakeholders within the ecosystem.

Benefit to the Landscape

Bank-Vaults is a well-known solution in the Cloud Native ecosystem. It’s been around longer than most of the competing projects (in fact, Bank-Vaults served as an inspiration for some of them). When looking at secret management solutions in the Cloud Native ecosystem (particularly Kubernetes), Bank-Vaults represents one of the established models for application secret management.

Cloud Native 'Fit'

Bank-Vaults best fits under the Security & Compliance category.

Cloud Native 'Integration'

The project does not depend on any CNCF projects per se. It uses various libraries (for example from Kubernetes). It primarily depends on Hashicorp Vault at the moment.

Cloud Native Overlap

There is no strong overlap with existing solutions. There are other secret management solutions in the CNCF landscape (for example External Secrets Operator), but it takes a fundamentally different approach to managing secrets. Also, Bank-Vaults has a much broader scope (for example has an operator for managing Vault on Kubernetes in addition to managing secret injection).

Similar projects

The aforementioned External Secrets Operator is what’s closest within the CNCF.

DoiT has a secrets-init component that’s basically a fork of the Vault secrets webhook implementing the same functionality for AWS and GCP secret managers (something that we also plan to add):

https://github.com/doitintl/secrets-init
https://github.com/doitintl/kube-secrets-init

(It’s basically unmaintained at this point)

Another tool based on Bank-Vaults’ webhook: https://github.com/innovia/secrets-consumer-webhook

Another similar tool (basically unmaintained): https://github.com/OT-CONTAINER-KIT/k8s-vault-webhook

Landscape

No

Business Product or Service to Project separation

N/A

Project presentations

Automating secret rotation in Kubernetes:
https://fosdem.org/2023/schedule/event/container_kubernetes_secret_rotation/

Automate Secret Rotation in Kubernetes, Then Get Out of the Way!:
https://www.youtube.com/watch?v=NTdyznb6Lc4

Project champions

@sagikazarmark
@justaugustus

Additional information

No response

[nikhita]

@sagikazarmark can you also present bank-vaults at a TAG Security meeting? Thanks!

[sagikazarmark]

@nikhita sure thing!

I opened an issue as per the TAG guidelines: cncf/tag-security#1103

[sagikazarmark]

@nikhita FYI I haven't received an answer for my presentation request yet. I tried to follow the process outlined in the tag-security repository. If you can help me find the right person/accelerate our request, that would be great.

Update: I managed to get a slot on the Sept 6th meeting.

Thanks!

[anvega]

Hey, I just wanted to chime in and say thanks to @sagikazarmark for presenting to TAG Security. It's very neat what Bank Vaults is doing. It's super cool how they've made the painful aspects of setting up and managing HashiCorp Vault a breeze, alleviating a lot of the complexities that can drive ops teams crazy. I've been a long fan of their approach to secret injection using mutating webhooks and an init container over Kubernetes Secrets or custom sidecars that was pioneered by them years ago in their time at Banzai Cloud and is now being contributed to the broader community under open governance. The other noteworthy feature set is the support for swappable encrypted backends to come with it.

And on a more official note, the TAG is supportive of the project's inclusion in the CNCF. This project is a game changer in advancing secrets management in the open. Its admission as a sandbox project will lend the opportunity to give it a closer look and help sharpen the value prop on how it does things that can't be done with Vault alone. Additionally, it will provide the opportunity for resourcing and tighter collaboration for us to assist in producing a detailed security assessment including a threat model asset.

The project team has expressed their intention to sign their release artifacts, which is a positive step towards enhancing security. We strongly encourage them to prioritize this aspect in the near term, along with considering other security practices outlined in the OpenSSF Best Practices. It's an opportune time to assess which practices are already in place and to work towards implementing those that are not yet addressed.

Last, it's worth noting that the project has demonstrated due diligence regarding license compliance and is in communication with the appropriate contacts within the CNCF to ensure alignment.

[sagikazarmark]

Thank you @anvega !

As said on the call, enhancing our supply chain security is on the roadmap, but it kinda stalled due to some of the tooling being overly complex in our opinion.

We would be happy to collaborate with the TAG on that as well as the threat assessment exercise mentioned on the call.

I've set up a board for tracking improvements to supply chain security: Supply chain security improvements