chore(keeper-injector): release chart 0.11.0

charts/keeper-injector/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: keeper-injector
 description: Keeper Secrets Manager Kubernetes Injector - Inject secrets into pods at runtime
 type: application
-version: 0.10.0
-appVersion: "0.10.0"
+version: 0.11.0
+appVersion: "0.11.0"
 kubeVersion: ">=1.21.0-0"
 home: https://www.keepersecurity.com
 icon: https://keepersecurity.com/vault/images/keeper_icons/icon_rounded_256.png
@@ -37,5 +37,15 @@ annotations:
     - name: Support
       url: https://github.com/Keeper-Security/keeper-k8s-injector/issues
   artifacthub.io/changes: |
+    - kind: fixed
+      description: Go templates (Sprig) in the keeper.security/config block now render correctly (were silently dropped and fell back to JSON)
+    - kind: fixed
+      description: Kubernetes Secret injection now works with default settings; the owner reference no longer causes the pod to be rejected at admission
+    - kind: fixed
+      description: keeper.security/signal no longer crashes the sidecar
+    - kind: fixed
+      description: Cloud auth (AWS/GCP/Azure) pods now deploy with file-based injection (the empty auth Secret reference is no longer injected)
+    - kind: security
+      description: Reject cross-namespace Kubernetes Secret writes and validate keeper.security/auth-method at admission
     - kind: changed
-      description: Renamed annotation from keeper.security/auth-secret to keeper.security/ksm-config for clarity - users must update pod annotations
+      description: Injected files are now mode 0440 (group-readable via pod fsGroup); the default K8s Secret no longer sets a pod owner reference, so it is not auto-deleted on pod termination

charts/keeper-injector/README.md

@@ -4,7 +4,7 @@ Automatically inject secrets from [Keeper Secrets Manager](https://www.keepersec
 
 ## Features
 
-- **No Kubernetes Secrets created** - Secrets are written directly to pod tmpfs (memory-only)
+- **No Kubernetes Secrets by default** - Secrets are written directly to pod tmpfs (memory-only); an optional **Kubernetes Secret mode** can create a native `Secret` when an app needs one (e.g., env vars)
 - **Pod-scoped lifetime** - Secrets are removed when pod terminates
 - **Automatic rotation** - Sidecar refreshes secrets without pod restarts
 - **Simple configuration** - Just two annotations to get started
@@ -62,7 +62,7 @@ metadata:
   name: my-app
   annotations:
     keeper.security/inject: "true"
-    keeper.security/auth-secret: "keeper-credentials"
+    keeper.security/ksm-config: "keeper-credentials"
     keeper.security/secret: "database-credentials"
 spec:
   containers:
@@ -81,28 +81,28 @@ Secrets will be available at `/keeper/secrets/database-credentials.json`.
 | `replicaCount` | Number of webhook replicas | `2` |
 | `image.repository` | Webhook image | `keeper/injector-webhook` |
 | `image.tag` | Image tag | Chart appVersion |
-| `sidecar.image.repository` | Sidecar image | `keeper/injector-sidecar` |
-| `sidecar.image.tag` | Sidecar image tag | Chart appVersion |
+| `sidecar.repository` | Sidecar image | `keeper/injector-sidecar` |
+| `sidecar.tag` | Sidecar image tag | Chart appVersion |
 | `metrics.enabled` | Enable Prometheus metrics | `true` |
 | `tls.autoGenerate` | Auto-generate TLS certificates | `true` |
 | `tls.certManager.enabled` | Use cert-manager (optional) | `false` |
 
 ### Full Configuration
 
-See [values.yaml](https://github.com/Keeper-Security/keeper-k8s-injector/blob/main/charts/keeper-injector/values.yaml) for all options.
+See [values.yaml](https://github.com/Keeper-Security/helm-charts/blob/main/charts/keeper-injector/values.yaml) for all options.
 
 ## Common Annotations
 
 | Annotation | Description | Example |
 |------------|-------------|---------|
 | `keeper.security/inject` | Enable injection | `"true"` |
-| `keeper.security/auth-secret` | K8s secret with KSM config | `"keeper-credentials"` |
+| `keeper.security/ksm-config` | K8s secret with KSM config (key `config`) | `"keeper-credentials"` |
 | `keeper.security/secret` | Secret title in Keeper | `"my-secret"` |
 | `keeper.security/secrets` | Multiple secrets (comma-separated) | `"db-creds, api-keys"` |
 | `keeper.security/refresh-interval` | Rotation interval | `"5m"` |
 | `keeper.security/signal` | Signal on refresh | `"SIGHUP"` |
 
-[Full annotation reference](https://github.com/Keeper-Security/keeper-k8s-injector/blob/main/docs/annotations.md)
+[Full annotation reference](https://github.com/Keeper-Security/keeper-k8s-injector/blob/main/docs/INDEX.md)
 
 ## Examples
 
@@ -136,9 +136,9 @@ Try these working examples:
 
 | Feature | Keeper Injector | ESO |
 |---------|-----------------|-----|
-| Creates K8s Secrets | No | Yes |
-| Secret storage | Pod tmpfs (memory) | etcd |
-| Secrets in etcd backups | No | Yes |
+| Creates K8s Secrets | Optional (default: no) | Yes |
+| Secret storage | Pod tmpfs (memory), or K8s Secret if opted in | etcd |
+| Secrets in etcd backups | No (default) | Yes |
 | Configuration | Annotations | CRDs |
 | Runtime rotation | Yes (sidecar) | Sync interval |
 | Pod isolation | Yes | Shared secrets |

charts/keeper-injector/templates/NOTES.txt

@@ -26,20 +26,21 @@ TLS: Manual certificates provided
 {{- end }}
 
 Secrets will be written to: /keeper/secrets/
-Format: JSON (default) or configurable via annotations
-Example: /keeper/secrets/database-credentials.json
+Default format: JSON. Example: /keeper/secrets/database-credentials.json
 
-Available formats:
-- JSON (default): keeper.security/format: "json"
-- Environment: keeper.security/format: "env"
-- YAML: keeper.security/format: "yaml"
-- Properties: keeper.security/format: "properties"
-- Custom: keeper.security/template: "your-template"
+Output formats (json, env, yaml, properties, ini, raw) and Go templates are set
+per-secret in the keeper.security/config block, e.g.:
+
+   keeper.security/config: |
+     secrets:
+       - record: database-credentials
+         path: /keeper/secrets/db.env
+         format: env
 
 Next Steps:
-1. Create a Kubernetes secret with your KSM configuration:
+1. Create a Kubernetes secret with your KSM configuration (key must be "config"):
 
-   kubectl create secret generic keeper-auth \
+   kubectl create secret generic keeper-credentials \
      --from-literal=config='<base64-ksm-config>' \
      --namespace <your-namespace>
 
@@ -50,7 +51,7 @@ Next Steps:
    metadata:
      annotations:
        keeper.security/inject: "true"
-       keeper.security/auth-secret: "keeper-auth"
+       keeper.security/ksm-config: "keeper-credentials"
        keeper.security/secret: "your-secret-title"
 
 For more information: