diff --git a/charts/keeper-injector/Chart.yaml b/charts/keeper-injector/Chart.yaml index e4aab88..027a04c 100644 --- a/charts/keeper-injector/Chart.yaml +++ b/charts/keeper-injector/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 name: keeper-injector description: Keeper Secrets Manager Kubernetes Injector - Inject secrets into pods at runtime type: application -version: 0.10.0 -appVersion: "0.10.0" +version: 0.11.0 +appVersion: "0.11.0" kubeVersion: ">=1.21.0-0" home: https://www.keepersecurity.com icon: https://keepersecurity.com/vault/images/keeper_icons/icon_rounded_256.png @@ -37,5 +37,15 @@ annotations: - name: Support url: https://github.com/Keeper-Security/keeper-k8s-injector/issues artifacthub.io/changes: | + - kind: fixed + description: Go templates (Sprig) in the keeper.security/config block now render correctly (were silently dropped and fell back to JSON) + - kind: fixed + description: Kubernetes Secret injection now works with default settings; the owner reference no longer causes the pod to be rejected at admission + - kind: fixed + description: keeper.security/signal no longer crashes the sidecar + - kind: fixed + description: Cloud auth (AWS/GCP/Azure) pods now deploy with file-based injection (the empty auth Secret reference is no longer injected) + - kind: security + description: Reject cross-namespace Kubernetes Secret writes and validate keeper.security/auth-method at admission - kind: changed - description: Renamed annotation from keeper.security/auth-secret to keeper.security/ksm-config for clarity - users must update pod annotations + description: Injected files are now mode 0440 (group-readable via pod fsGroup); the default K8s Secret no longer sets a pod owner reference, so it is not auto-deleted on pod termination diff --git a/charts/keeper-injector/README.md b/charts/keeper-injector/README.md index e40645e..1735fb7 100644 --- a/charts/keeper-injector/README.md +++ b/charts/keeper-injector/README.md @@ -4,7 +4,7 @@ Automatically inject secrets from [Keeper Secrets Manager](https://www.keepersec ## Features -- **No Kubernetes Secrets created** - Secrets are written directly to pod tmpfs (memory-only) +- **No Kubernetes Secrets by default** - Secrets are written directly to pod tmpfs (memory-only); an optional **Kubernetes Secret mode** can create a native `Secret` when an app needs one (e.g., env vars) - **Pod-scoped lifetime** - Secrets are removed when pod terminates - **Automatic rotation** - Sidecar refreshes secrets without pod restarts - **Simple configuration** - Just two annotations to get started @@ -62,7 +62,7 @@ metadata: name: my-app annotations: keeper.security/inject: "true" - keeper.security/auth-secret: "keeper-credentials" + keeper.security/ksm-config: "keeper-credentials" keeper.security/secret: "database-credentials" spec: containers: @@ -81,28 +81,28 @@ Secrets will be available at `/keeper/secrets/database-credentials.json`. | `replicaCount` | Number of webhook replicas | `2` | | `image.repository` | Webhook image | `keeper/injector-webhook` | | `image.tag` | Image tag | Chart appVersion | -| `sidecar.image.repository` | Sidecar image | `keeper/injector-sidecar` | -| `sidecar.image.tag` | Sidecar image tag | Chart appVersion | +| `sidecar.repository` | Sidecar image | `keeper/injector-sidecar` | +| `sidecar.tag` | Sidecar image tag | Chart appVersion | | `metrics.enabled` | Enable Prometheus metrics | `true` | | `tls.autoGenerate` | Auto-generate TLS certificates | `true` | | `tls.certManager.enabled` | Use cert-manager (optional) | `false` | ### Full Configuration -See [values.yaml](https://github.com/Keeper-Security/keeper-k8s-injector/blob/main/charts/keeper-injector/values.yaml) for all options. +See [values.yaml](https://github.com/Keeper-Security/helm-charts/blob/main/charts/keeper-injector/values.yaml) for all options. ## Common Annotations | Annotation | Description | Example | |------------|-------------|---------| | `keeper.security/inject` | Enable injection | `"true"` | -| `keeper.security/auth-secret` | K8s secret with KSM config | `"keeper-credentials"` | +| `keeper.security/ksm-config` | K8s secret with KSM config (key `config`) | `"keeper-credentials"` | | `keeper.security/secret` | Secret title in Keeper | `"my-secret"` | | `keeper.security/secrets` | Multiple secrets (comma-separated) | `"db-creds, api-keys"` | | `keeper.security/refresh-interval` | Rotation interval | `"5m"` | | `keeper.security/signal` | Signal on refresh | `"SIGHUP"` | -[Full annotation reference](https://github.com/Keeper-Security/keeper-k8s-injector/blob/main/docs/annotations.md) +[Full annotation reference](https://github.com/Keeper-Security/keeper-k8s-injector/blob/main/docs/INDEX.md) ## Examples @@ -136,9 +136,9 @@ Try these working examples: | Feature | Keeper Injector | ESO | |---------|-----------------|-----| -| Creates K8s Secrets | No | Yes | -| Secret storage | Pod tmpfs (memory) | etcd | -| Secrets in etcd backups | No | Yes | +| Creates K8s Secrets | Optional (default: no) | Yes | +| Secret storage | Pod tmpfs (memory), or K8s Secret if opted in | etcd | +| Secrets in etcd backups | No (default) | Yes | | Configuration | Annotations | CRDs | | Runtime rotation | Yes (sidecar) | Sync interval | | Pod isolation | Yes | Shared secrets | diff --git a/charts/keeper-injector/templates/NOTES.txt b/charts/keeper-injector/templates/NOTES.txt index e0400ad..fb8a698 100644 --- a/charts/keeper-injector/templates/NOTES.txt +++ b/charts/keeper-injector/templates/NOTES.txt @@ -26,20 +26,21 @@ TLS: Manual certificates provided {{- end }} Secrets will be written to: /keeper/secrets/ -Format: JSON (default) or configurable via annotations -Example: /keeper/secrets/database-credentials.json +Default format: JSON. Example: /keeper/secrets/database-credentials.json -Available formats: -- JSON (default): keeper.security/format: "json" -- Environment: keeper.security/format: "env" -- YAML: keeper.security/format: "yaml" -- Properties: keeper.security/format: "properties" -- Custom: keeper.security/template: "your-template" +Output formats (json, env, yaml, properties, ini, raw) and Go templates are set +per-secret in the keeper.security/config block, e.g.: + + keeper.security/config: | + secrets: + - record: database-credentials + path: /keeper/secrets/db.env + format: env Next Steps: -1. Create a Kubernetes secret with your KSM configuration: +1. Create a Kubernetes secret with your KSM configuration (key must be "config"): - kubectl create secret generic keeper-auth \ + kubectl create secret generic keeper-credentials \ --from-literal=config='' \ --namespace @@ -50,7 +51,7 @@ Next Steps: metadata: annotations: keeper.security/inject: "true" - keeper.security/auth-secret: "keeper-auth" + keeper.security/ksm-config: "keeper-credentials" keeper.security/secret: "your-secret-title" For more information: