Skip to content

Commit 78f86f1

Browse files
iamabhishek-dubeyiamabhishek-dubey
authored
[Feature][Add] Added AWS secret manager support (#10)
* Added Badges for Project Signed-off-by: iamabhishek-dubey <abhishekbhardwaj510@gmail.com> * Added Badges for Project Signed-off-by: iamabhishek-dubey <abhishekbhardwaj510@gmail.com> * Added Badges for Project Signed-off-by: iamabhishek-dubey <abhishekbhardwaj510@gmail.com> * Added Badges for Project Signed-off-by: iamabhishek-dubey <abhishekbhardwaj510@gmail.com> * Added AWS secret manager support Signed-off-by: iamabhishek-dubey <abhishekbhardwaj510@gmail.com> * Added an example for AWS Signed-off-by: iamabhishek-dubey <abhishekbhardwaj510@gmail.com> * Added AWS information in README Signed-off-by: iamabhishek-dubey <abhishekbhardwaj510@gmail.com> * Added AWS information in README Signed-off-by: iamabhishek-dubey <abhishekbhardwaj510@gmail.com> * Updated docs with latest information Signed-off-by: iamabhishek-dubey <abhishekbhardwaj510@gmail.com>
1 parent 52cbee2 commit 78f86f1

25 files changed

+301
-23
lines changed

‎CHANGELOG.md

+9
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
### v2.0
2+
##### May 8, 2021
3+
4+
#### :tada: [Features Added]
5+
6+
- Added AWS Secret Manager support
7+
- Inject secret directly to pods/containers from AWS Secret Manager
8+
- Authentication with AWS Secret Manager with access key and iam role
9+
110
### v1.0
211
##### April 11, 2021
312

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
REGISTRY ?= quay.io
33
REPOSITORY ?= $(REGISTRY)/opstree
44
ARTIFACT_NAME=k8s-vault-webhook
5-
VERSION = 1.0
5+
VERSION = 2.0
66

77
all: build-code build-image
88

‎README.md

+3-11
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,10 @@ Documentation is available here:- https://ot-container-kit.github.io/k8s-vault-w
3131
The secret managers which are currently supported:-
3232

3333
- **[Hashicorp Vault](https://www.vaultproject.io/)**
34+
- **[AWS Secret Manager](https://aws.amazon.com/secrets-manager/)**
3435

3536
There are some secret managers which are planned to be implemented in future.
3637

37-
- **[AWS Secret Manager](https://aws.amazon.com/secrets-manager/)**
3838
- **[Azure Key Vault](https://azure.microsoft.com/en-in/services/key-vault/)**
3939
- **[GCP Secret Manager](https://cloud.google.com/secret-manager)**
4040

@@ -43,6 +43,8 @@ There are some secret managers which are planned to be implemented in future.
4343
- Authentication to Hashicorp vault using Kubernetes service-account
4444
- RBAC implementation of vault using different policies of vault and association of policy with service-account
4545
- Inject secret directly to pods/containers running inside Kubernetes
46+
- Inject secret directly to pods/containers from AWS Secret Manager
47+
- Authentication with AWS Secret Manager with access key and iam role
4648
- Support regex to inject all secrets from a certain path of Vault
4749
- Inject secrets directly to the process of container, i.e. after the injection you cannot read secrets from the environment variable
4850

@@ -64,16 +66,6 @@ $ helm upgrade k8s-vault-webhook ot-helm/k8s-vault-webhook --namespace <namespac
6466

6567
If you want to pass your custom values file while installing the chart, you can find the values file [here](https://github.com/OT-CONTAINER-KIT/helm-charts/blob/main/charts/k8s-vault-webhook/values.yaml)
6668

67-
### Annotations
68-
69-
|**Name**|**Description**|**Required**|**Default**|
70-
|--------|---------------|------------|-----------|
71-
|`vault.opstree.secret.manager/enabled`| Enables the vault secret manager | - | false |
72-
|`vault.opstree.secret.manager/service`| Vault cluster address with http prefix | yes | - |
73-
|`vault.opstree.secret.manager/tls-secret`| Vault TLS secret name if vault is configured on TLS | no | - |
74-
|`vault.opstree.secret.manager/role`| Vault role created with Kubernetes serviceaccount | yes | - |
75-
|`vault.opstree.secret.manager/path`| Path of the secret in vault | no | - |
76-
7769
### Quickstart
7870

7971
For setting up a quickstart environment for demo, you can start quickstart from [here](https://ot-container-kit.github.io/k8s-vault-webhook/)

‎annotations.go

+15
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,21 @@
11
package main
22

33
const (
4+
// AnnotationAWSSecretManagerEnabled if enabled it will use AWS secret manager
5+
AnnotationAWSSecretManagerEnabled = "aws.opstree.secret.manager/enabled"
6+
7+
// AnnotationAWSSecretManagerRegion the region for which the secret manager is set
8+
AnnotationAWSSecretManagerRegion = "aws.opstree.secret.manager/region"
9+
10+
// AnnotationAWSSecretManagerRoleARN if specified it will assume the role for fetching the secret
11+
AnnotationAWSSecretManagerRoleARN = "aws.opstree.secret.manager/role-arn"
12+
13+
// AnnotationAWSSecretManagerSecretName aws secret manager secret name to fetch
14+
AnnotationAWSSecretManagerSecretName = "aws.opstree.secret.manager/secret-name"
15+
16+
// AnnotationAWSSecretManagerPreviousVersion when used will retrive the previous version for the secret
17+
// note that AWS only supports single previous version
18+
AnnotationAWSSecretManagerPreviousVersion = "aws.opstree.secret.manager/previous-version"
419

520
// AnnotationVaultEnabled if enabled use vault as the secret manager
621
AnnotationVaultEnabled = "vault.opstree.secret.manager/enabled"

‎aws.go

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
package main
2+
3+
import (
4+
"fmt"
5+
6+
corev1 "k8s.io/api/core/v1"
7+
)
8+
9+
type aws struct {
10+
config struct {
11+
enabled bool
12+
region string
13+
secretName string
14+
previousVersion string
15+
roleARN string
16+
}
17+
}
18+
19+
func (aws *aws) mutateContainer(container corev1.Container) corev1.Container {
20+
container = aws.setArgs(container)
21+
return container
22+
}
23+
24+
func (aws *aws) setArgs(c corev1.Container) corev1.Container {
25+
args := []string{"aws"}
26+
args = append(args, fmt.Sprintf("--region=%s", aws.config.region))
27+
28+
if aws.config.secretName != "" {
29+
args = append(args, fmt.Sprintf("--secret-name=%s", aws.config.secretName))
30+
}
31+
32+
if aws.config.roleARN != "" {
33+
args = append(args, fmt.Sprintf("--role-arn=%s", aws.config.roleARN))
34+
}
35+
36+
if aws.config.secretName != "" {
37+
args = append(args, fmt.Sprintf("--previous-version=%s", aws.config.previousVersion))
38+
}
39+
40+
args = append(args, "--")
41+
c.Args = append(args, c.Args...)
42+
return c
43+
}

‎docs/src/.vuepress/config.js

+2
Original file line numberDiff line numberDiff line change
@@ -69,13 +69,15 @@ module.exports = {
6969
collapsable: false,
7070
children: [
7171
'hashicorp-vault',
72+
'aws-secret-manager',
7273
]
7374
},
7475
{
7576
title: 'Examples',
7677
collapsable: false,
7778
children: [
7879
'hashicorp-vault-example',
80+
'aws-secret-manager-example',
7981
]
8082
},
8183
{

‎docs/src/guide/README.md

+13-3
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ Documentation is available here:- [https://ot-container-kit.github.io/k8s-vault-
1212
The secret managers which are currently supported:-
1313

1414
- **[Hashicorp Vault](https://www.vaultproject.io/)**
15+
- **[AWS Secret Manager](https://aws.amazon.com/secrets-manager/)**
1516

1617
There are some secret managers which are planned to be implemented in future.
1718

18-
- **[AWS Secret Manager](https://aws.amazon.com/secrets-manager/)**
1919
- **[Azure Key Vault](https://azure.microsoft.com/en-in/services/key-vault/)**
2020
- **[GCP Secret Manager](https://cloud.google.com/secret-manager)**
2121

@@ -24,11 +24,21 @@ There are some secret managers which are planned to be implemented in future.
2424
- Authentication to Hashicorp vault using Kubernetes service-account
2525
- RBAC implementation of vault using different policies of vault and association of policy with service-account
2626
- Inject secret directly to pods/containers running inside Kubernetes
27+
- Inject secret directly to pods/containers from AWS Secret Manager
28+
- Authentication with AWS Secret Manager with access key and iam role
2729
- Support regex to inject all secrets from a certain path of Vault
2830
- Inject secrets directly to the process of container, i.e. after the injection you cannot read secrets from the environment variable
2931

3032
## Architecture
3133

32-
<div align="center">
33-
<img src="./images/k8s-vault-webhook-arc.png">
34+
### Hashicorp Vault
35+
36+
<div align="center" style="padding-top: 25px;">
37+
<img src="./images/k8s-vault-webhook-arc-vault.png">
38+
</div>
39+
40+
### AWS Secret Manager
41+
42+
<div align="center" style="padding-top: 25px;">
43+
<img src="./images/k8s-vault-webhook-arc-aws.png">
3444
</div>

‎docs/src/guide/annotations.md

+11-1
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ Based on these annotations, the secrets will be mutated.
66
The annotations which are currently supported:-
77

88
- **[Hashicorp Vault](https://www.vaultproject.io/)**
9+
- **[AWS Secret Manager](https://aws.amazon.com/secrets-manager/)**
910

1011
There are some other annotations which are planned to be implemented in future.
1112

12-
- **[AWS Secret Manager](https://aws.amazon.com/secrets-manager/)**
1313
- **[Azure Key Vault](https://azure.microsoft.com/en-in/services/key-vault/)**
1414
- **[GCP Secret Manager](https://cloud.google.com/secret-manager)**
1515

@@ -29,3 +29,13 @@ The available annotations for k8s vault webhook are:-
2929
|`vault.opstree.secret.manager/secret-version` | Vault secret version (if using v2 secret engine) | Yes | - |
3030
|`vault.opstree.secret.manager/use-secret-names-as-keys` | treat secret path ending with / as directory where secret name is the key and a single value in each | No | - |
3131
|`vault.opstree.secret.manager/auth-path`| alternate kubernetes backend auth path | No | `auth/kubernetes/login` |
32+
33+
## AWS Annotations
34+
35+
|**Name**|**Description**|**Required**|**Default**|
36+
|--------|---------------|------------|-----------|
37+
|`aws.secret.manager/enabled`| Enable the AWS secret manager | - | false |
38+
|`aws.secret.manager/region`| AWS secret manager region | no | us-east-1 |
39+
|`aws.secret.manager/role-arn`| AWS IAM Role to access the secret | no | |
40+
|`aws.secret.manager/secret-name`| Name of the AWS secret | no | |
41+
|`aws.secret.manager/previous-version`| If the secret is rotated, set to "true" | no | |

‎docs/src/guide/aws-secret-manager-example.md

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# AWS Secret Manager
2+
3+
Let's try to create a deployment to inject secrets directly from AWS Secret Manager. For example, purpose we are taking mysql as deployment and then we will try to set mysql root password using k8s-vault-webhook.
4+
5+
We can use our [example](https://github.com/OT-CONTAINER-KIT/k8s-vault-webhook/tree/master/example) folder.
6+
7+
The environment variables will get substitute automatically, we just have to provide some custom annotations.
8+
9+
```yaml
10+
template:
11+
metadata:
12+
labels:
13+
app: k8s-aws-mysql
14+
tier: mysql
15+
annotations:
16+
aws.opstree.secret.manager/enabled: "true"
17+
aws.opstree.secret.manager/region: "us-west-2"
18+
# Use this role-arn if cluster is configured in AWS
19+
# aws.opstree.secret.manager/role-arn: "arn:aws:iam::999:role/secretManager"
20+
aws.opstree.secret.manager/secret-name: "test-secret"
21+
spec:
22+
containers:
23+
- image: opstree/mysql:latest
24+
name: mysql
25+
# If running outside AWS
26+
env:
27+
- name: AWS_ACCESS_KEY_ID
28+
valueFrom:
29+
secretKeyRef:
30+
name: aws-secret
31+
key: AWS_ACCESS_KEY_ID
32+
- name: AWS_SECRET_ACCESS_KEY
33+
valueFrom:
34+
secretKeyRef:
35+
name: aws-secret
36+
key: AWS_SECRET_ACCESS_KEY
37+
```
38+
39+
Let's try to apply the deployment manifest.
40+
41+
```shell
42+
$ kubectl apply -f example/aws-mysql-example.yaml
43+
...
44+
deployment.apps/k8s-aws-mysql configured
45+
```
46+
47+
Verify the mysql pods are running or not by using `kubectl` command line.
48+
49+
```shell
50+
$ kubectl get pods
51+
...
52+
NAME READY STATUS RESTARTS AGE
53+
k8s-aws-mysql-5fcb986486-npjql 1/1 Running 0 16h
54+
```
55+
56+
Now let's try to get inside the `mysql` pod and see if the AWS Secret Manager's password is working fine or not.
57+
58+
```shell
59+
$ kubectl exec -it k8s-aws-mysql-5fcb986486-npjql \
60+
-- mysql -u root -pawspassword -e "show databases;"
61+
...
62+
Warning: Using a password on the command line interface can be insecure.
63+
+--------------------+
64+
| Database |
65+
+--------------------+
66+
| information_schema |
67+
| mysql |
68+
| performance_schema |
69+
+--------------------+
70+
```
71+
72+
Also, try to check the value in environment variable of MySQL pod.
73+
74+
```shell
75+
$ kubectl exec -it k8s-aws-mysql-5fcb986486-npjql \
76+
-- env | grep ROOT
77+
...
78+
No output
79+
```

‎docs/src/guide/aws-secret-manager.md

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# AWS Secret Manager
2+
3+
For integrating AWS Secret Manager with the K8s Vault Webhook, first we need to setup AWS Secret Manager inside AWS account.
4+
5+
Here we will talk about the integration of AWS Secret Manager inside Kubernetes.
6+
7+
## Secret Manager Setup
8+
9+
Login into the [AWS Management Console](https://console.aws.amazon.com/console/home?nc2=h_ct&src=header-signin) and select [AWS Secret Manager](https://aws.amazon.com/secrets-manager/) service.
10+
11+
![](./images/aws-secret-manager-aws.png)
12+
13+
Create a secret in the secret-manager and select the secret type `Other type of secrets` and specify the key value pairs with these details.
14+
15+
|**Key**|**Value**|
16+
|-------|---------|
17+
| MYSQL_ROOT_PASSWORD | awspassword |
18+
19+
![](./images/aws-secret-manager-config.png)
20+
21+
You should provide and description as well to the secret.
22+
23+
![](./images/aws-secret-manager-name.png)
24+
25+
Create the secret after all configuration to use it inside Kubernetes.

‎docs/src/guide/changelog.md

+9
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
### v2.0
2+
**May 8, 2021**
3+
4+
**:tada: [Features Added]**
5+
6+
- Added AWS Secret Manager support
7+
- Inject secret directly to pods/containers from AWS Secret Manager
8+
- Authentication with AWS Secret Manager with access key and iam role
9+
110
### v1.0
211
**April 11, 2021**
312

‎docs/src/guide/configuration.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ There is not alot of configuration changes requires to deploy K8s Vault Webhook.
1010
|debug| debug logs for webhook | `false` |
1111
|image.pullPolicy| image pull policy | `IfNotPresent`|
1212
|image.repository| image repo that contains the admission server | `quay.io/opstree/k8s-vault-webhook` |
13-
|image.tag| image tag for admission server | `1.0` |
13+
|image.tag| image tag for admission server | `2.0` |
1414
|image.imagePullSecrets| image pull secrets for private repositories | `[]` |
1515
|namespaceSelector| namespace selector to use, will limit webhook scope | `{}` |
1616
|nodeSelector|node selector to use | `{}` |
@@ -24,7 +24,7 @@ There is not alot of configuration changes requires to deploy K8s Vault Webhook.
2424
|rbac.enabled |use rbac | `true` |
2525
|rbac.psp.enabled |use pod security policy | `true` |
2626
|env.VAULT_IMAGE | vault image | `vault:latest` |
27-
|env.SECRET_CONSUMER_ENV_IMAGE | vault-env image | `quay.io/opstree/k8s-secret-injector:1.0` |
27+
|env.K8S_SECRET_INJECTOR_IMAGE | vault-env image | `quay.io/opstree/k8s-secret-injector:2.0` |
2828
|volumes |extra volume definitions | `[]` |
2929
|volumeMounts |extra volume mounts | `[]` |
3030
| configMapMutation | enable injecting values from Vault to ConfigMaps | `false` |

‎docs/src/guide/images/aws-secret-manager-arc.jpg

141 KB
Loading

‎docs/src/guide/images/aws-secret-manager-aws.png

54.5 KB
Loading

‎docs/src/guide/images/aws-secret-manager-config.png

63.6 KB
Loading

‎docs/src/guide/images/aws-secret-manager-name.png

55.7 KB
Loading

‎docs/src/guide/images/k8s-vault-webhook-arc-aws.png

295 KB
Loading

‎docs/src/guide/images/k8s-vault-webhook-arc-vault.png

339 KB
Loading

‎docs/src/guide/images/k8s-vault-webhook-arc-vault.svg

+16
Loading

‎docs/src/guide/secret-manager.md

+2
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ Vault comes with various pluggable components called secrets engines and authent
2525

2626
AWS Secrets Manager helps you protect secrets needed to access your applications, services, and IT resources. The service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.
2727

28+
![](./images/aws-secret-manager-arc.jpg)
29+
2830
## Azure Key Vault
2931

3032
Azure Key Vault is cloud service to securely store and accessing credentials such as API Keys, passwords, certificates or cryptographic keys.

‎docs/src/index.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
home: true
3-
heroImage: https://github.com/OT-CONTAINER-KIT/k8s-vault-webhook/raw/master/static/k8s-vault-webhook-logo.svg
3+
heroImage: https://github.com/OT-CONTAINER-KIT/k8s-vault-webhook/raw/master/docs/src/guide/images/k8s-vault-webhook-logo.svg
44
tagline: A k8s vault webhook is a Kubernetes webhook that can inject secrets into Kubernetes resources by connecting to multiple secret managers
55
actionText: Quick Start →
66
actionLink: /guide/

0 commit comments

Comments
 (0)