Abstracting secret management from values repo PoC

[j-zimnowoda]

**Is your feature request related to a problem? **

The current secret management implementation:

• does not support multi tenancy, so a user can either decrypt all secrets or non of them.
• enforces storing secrets in a separate files, what is a source of data management and data merge issues.

We need robust, multi-tenant secret management solution that integrates seamlessly with Kubernetes but also is suitable for GitOps approach. The solution should also provide secret rotations out of the box.

For more information see discussion: #279

Describe the solution you'd like
I would like to have vault a a secret manager.

First of of Valut seems to be a great candidate as it provides:

• multitenancy
• key rotation
• web interface

Unfortunately, it does not support secrets injection as ENV vars (link)

There are two solutions that could meet our requirements:

• Vault combined with bank-vaults
• Vault combined with kubernetes-external-secrets

Related tasks:

• prepare PoC and make a demo for a team
  • integrate vault operator chart from bank-vaults
  • integrate vault authentication OIDC with keycloak
  • expose vault service via public url
  • enforce vault secrets access control based on JWT groups claim
  • integrate kubernetes-extrenal-secrets project
  • integrate mutation webhook for injecting vault secrets directly to the container from bank-vaults
• collect requirements
• prepare user stories (in-progress)

[0-sv]

Awesome. The tradeoff between kubernetes-external-secret and bank-vault seems tricky, they both seem to be maintained equally well. I guess bank-vault offers more features and has 50 more collaborators, but then again, the other project is created for solving this problem specifically, correct?

[j-zimnowoda]

Indeed, choosing the one is tricky. Intuitively, I like more bank-vaults, because of it's simplicity in terms of referencing to a secret value. But let's make our hands dirty first and then we can decide which one does better work for us.

The kubernetes-external-secrets can integrate more seamlessly but if has some disadvantages that I would like to avoid.

[Morriz]

I prefer bank-vaults as it fits more tightly. The other one is offering an interface that is too wide. So if the POC with bank-vaults feels nice we can just continue with that imo.

[j-zimnowoda]

Yes, I am going to start with bank-vaults

[j-zimnowoda]

Discussion is finished. Requirements are complete and user stories defined.