Project status: Stable - multipal financial institutions are running this project on production Kubernetes clusters
Read the announcement: https://mrdevops.io/introducing-azure-key-vault-to-kubernetes-931f82364354
Full documentation available at https://akv2k8s.io
Azure Key Vault to Kubernetes (akv2k8s) has two components for handling Azure Key Vault Secrets in Kubernetes:
- Azure Key Vault Controller
- Azure Key Vault Env Injector
The Azure Key Vault Controller (Controller for short) is for synchronizing Secrets, Certificates and Keys from Azure Key Vault to native Secret's in Kubernetes.
The Azure Key Vault Env Injector (Env Injector for short) is a Kubernetes Mutating Webhook transparently injecting Azure Key Vault secrets as environment variables into programs running in containers, without touching disk or in any other way expose the actual secret content outside the program.
Goals for this project was:
- Avoid a direct program dependency on Azure Key Vault for getting secrets, and adhere to the 12 Factor App principle for configuration (https://12factor.net/config)
- Make it simple, secure and low risk to transfer Azure Key Vault secrets into Kubernetes as native Kubernetes secrets
- Securely and transparently be able to inject Azure Key Vault secrets as environment variables to applications, without having to use native Kubernetes secrets
All of these goals are met.
- Kubernetes version >= 1.13
- Enabled admission controllers: MutatingAdmissionWebhook and ValidatingAdmissionWebhook
- RBAC enabled
- Default authentication requires Kubernetes cluster running in Azure - use custom authentication if running outside Azure
It's recommended to use Helm charts for installation:
Controller: https://github.com/SparebankenVest/public-helm-charts/tree/master/stable/azure-key-vault-controller
Env Injector: https://github.com/SparebankenVest/public-helm-charts/tree/master/stable/azure-key-vault-env-injector
For more details, see full documentation at https://akv2k8s.io.
If Helm is not an option in Kubernetes, use Helm on a local computer to generate the Kubernetes templates like below:
helm install --debug --dry-run <options>
See the individual Helm charts above for <options>.
Credit goes to Banzai Cloud for coming up with the original idea of environment injection for their bank-vaults solution, which they use to inject Hashicorp Vault secrets into Pods.
Development of Azure Key Vault for Kubernetes happens in the open on GitHub, and encourage users to:
- Send a pull request with
- any security issues found and fixed
- your new features and bug fixes
- updates and improvements to the documentation
- Report issues on security or other issues you have come across
- Help new users with issues they may encounter
- Support the development of this project and star this repo!
Sparebanken Vest has adopted a Code of Conduct that we expect project participants to adhere to. Please read the full text so that you can understand what actions will and will not be tolerated.
Azure Key Vault to Kubernetes is licensed under Apache License 2.0.
The documentation is located at docs/content. We're using Gatsby + MDX (Markdown + JSX) to generate static docs for https://akv2k8s.io. See docs/README.md for details.