策略引擎>> kubectl-vault_sync>> 返回
项目作者： postfinance

项目描述 ：
Kubernetes plugin to synchronize secrets from vault as kubernetes secrets.
高级语言： Go
项目地址: git://github.com/postfinance/kubectl-vault_sync.git
创建时间： 2019-05-03T11:01:22Z
项目社区：https://github.com/postfinance/kubectl-vault_sync
开源协议：MIT License
下载


vault_sync plugin

Release
Software License
Build
Go Report Card

asciicast

Concept

The vault_sync plugin is a k8s plugin to synchronize secrets from vault as kubernetes secrets.

It works in combination with the following projects:

It uses the following namespace annotations to create a batch job, that synchronizes secrets:

  • sync.vault.postfinance.ch/sync-image: the synchronizer image name (default: postfinance/vault-kubernetes-synchronizer:latest)
  • sync.vault.postfinance.ch/auth-image: the authorizer image name (default: postfinance/vault-kubernetes-authenticator:latest)
  • sync.vault.postfinance.ch/mount-path: the name of the mount where the kubernetes auth method is enabled (default: kubernetes)
  • sync.vault.postfinance.ch/secrets-path: the secrets path in vault that should be syncronized to kubernets
  • sync.vault.postfinance.ch/role: the name of the vault role to use for authentication
  • sync.vault.postfinance.ch/addr: the vault server’s URL
  • sync.vault.postfinance.ch/trust-secret: kubernetes secret containing a CA certificate ‘truststore.pem’ to connect to vault

Usage

To sync all secrets run:

  1. $ kubectl vault_sync
  2. creating sync batch job to synchronize 'secret/team_linux/k8s/k8s-np/appl-zoekt-e1/' vault key

This creates a batch job that synchronizes the secrets. You can view the job with:

  1. kubectl get job -l job=vault-sync
  2. NAME                         COMPLETIONS   DURATION   AGE
  3. vault-sync-20190412-101357   1/1           9s         103s

To check the logs run:

  1. $ kubectl logs $(kubectl get pods -l job-name -o jsonpath='{.items[0].metadata.name}')
  2. 2019/04/12 08:14:12 read secret/team_linux/k8s/k8s-np/appl-zoekt-e1/gitlab from vault
  3. 2019/04/12 08:14:12 update secret gitlab from vault secret secret/team_linux/k8s/k8s-np/appl-zoekt-e1/gitlab
  4. 2019/04/12 08:14:12 secrets successfully synchronized