Kubernetes External Secrets allows you to use external secret management systems, like AWS Secrets Manager or HashiCorp Vault, to securely add secrets in Kubernetes. Read more about the design and motivation for Kubernetes External Secrets on the GoDaddy Engineering Blog. The community and maintainers of this project and related Kubernetes secret management projects use the #external-secrets channel on the Kubernetes slack for discussion and brainstorming. The project extends the Kubernetes API by adding an ExternalSecrets object using Custom Resource Definition and a controller to implement the behavior of the object itself. An ExternalSecret declares how to fetch the secret data, while the controller converts all ExternalSecrets to Secrets. The conversion is completely transparent to Pods that can access Secrets normally. By default Secrets are not encrypted at rest and are open to attack, either via the etcd server or via backups of etcd data.
Features
- Useful to set endpoints for FIPS compliance
- Useful to set endpoints for FIPS compliance or regional latency
- You can specify a roleArn which will be assumed before retrieving the secret
- Controller fetches ExternalSecrets using the Kubernetes API
- The project extends the Kubernetes API by adding an ExternalSecrets object
- An ExternalSecret declares how to fetch the secret data
Project Samples
