vault-controller
Automate the creation of unique Vault tokens for Kubernetes Pods using init containers.
by kelseyhightowerGo
Meet the team
See all 2 on GitHub →
Commit activity
Last 12 weeks · 0 commits
Community health
2 of 6 standards met
42
✓README✓License○Contributing○Code of Conduct○Issue Template○PR Template
Recent PRs & issues
Quiet · 4 in progress · Last activity 6y ago
See all on GitHub →
This is a test against Kubernetes 1.6.1. Had to give vault-controller RBAC role permission to list pods in the cluster. After that, I am getting the following error: On the kube-apiserver side, the log shows: It seems the vault-controller is trying to get pod details from namespace /api/v1/namespaces/vault-example-lxx67/ instead of /api/v1/namespaces/vault-controller. The vault-example rs looks okay in vault-controller namespace: Anyone get it working with Kubernetes 1.6.1?
Response Wrapping link led to a dead blog page, and now it leads to a working and updated one.
Recent fixes
The current version doesn't work with k8s 1.8 or higher. Therefore I converted the initContainer syntax in the vault-example replicaset to 1.6 syntax. After this it works again like a charm :+1:
hey @kelseyhightower ! We started Boostport/kubernetes-vault last year because we needed a way to get Vault tokens into our pods, in order to use Vault as our secret manager. We recently found out about your project and noticed that our goals are essentially the same: to get a token into a pod securely. However, in terms of implementation our projects are quite different. Kubernetes-Vault uses AppRoles and a push approach, whereas Vault-Controller uses policies in an annotation and a pull approach. Would you be interested in exploring ways to join forces and merge our projects together? Cheers, Francis
Hello, am I right that AWS admin has access to all secrets? According to https://github.com/kelseyhightower/vault-controller/blob/master/docs/deployment-guide.md, the root token or admin token is written in kubernetes secret kubectl -n vault-controller \ create secret generic vault-controller \ from-literal "vault_token=3e4a5ba1-kube-422b-d1db-844979cab098" So AWS admin could read this config from kubernetes secret and use the token to read all secrets from vault?
Structured data for AI agents
Repository: kelseyhightower/vault-controller. Description: Automate the creation of unique Vault tokens for Kubernetes Pods using init containers. Stars: 443, Forks: 64. Primary language: Go. Languages: Go (95%), Shell (3.8%), HCL (1.3%). License: Apache-2.0. Open PRs: 4, open issues: 7. Last activity: 6y ago. Community health: 42%. Top contributors: kelseyhightower.