{"id":20858834,"url":"https://github.com/controlplaneio/vault-trust-operator","last_synced_at":"2026-06-01T09:32:07.189Z","repository":{"id":78747281,"uuid":"276863784","full_name":"controlplaneio/vault-trust-operator","owner":"controlplaneio","description":null,"archived":false,"fork":false,"pushed_at":"2020-08-26T14:22:27.000Z","size":26,"stargazers_count":4,"open_issues_count":5,"forks_count":0,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-12-25T21:25:02.842Z","etag":null,"topics":["kubernetes","vault"],"latest_commit_sha":null,"homepage":"","language":"Dockerfile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/controlplaneio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-07-03T09:41:42.000Z","updated_at":"2023-02-10T16:27:07.000Z","dependencies_parsed_at":"2023-03-01T03:15:45.041Z","dependency_job_id":null,"html_url":"https://github.com/controlplaneio/vault-trust-operator","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/controlplaneio/vault-trust-operator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/controlplaneio%2Fvault-trust-operator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/controlplaneio%2Fvault-trust-operator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/controlplaneio%2Fvault-trust-operator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/controlplaneio%2Fvault-trust-operator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/controlplaneio","download_url":"https://codeload.github.com/controlplaneio/vault-trust-operator/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/controlplaneio%2Fvault-trust-operator/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33769490,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-01T02:00:06.963Z","response_time":115,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["kubernetes","vault"],"created_at":"2024-11-18T04:47:42.066Z","updated_at":"2026-06-01T09:32:07.164Z","avatar_url":"https://github.com/controlplaneio.png","language":"Dockerfile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Vault Trust Operator\n\nThe Vault Trust Operator manages the trust between a K8S cluster and [Hashicorp Vault](https://www.vaultproject.io/).\n\nIn addition to the K8S resources required to run the operator, on deployment the following service accounts will be\ncreated\n\n*   `vault-token-reviewer` with cluster wide permissions to create tokenreviews\n*   `vault-trust-admin` with no k8s permissions\n\nWhen configuring a [Kubernetes Auth Method](https://www.vaultproject.io/docs/auth/kubernetes) the \n`vault-token-reviewer`'s JWT is used as part of the configuration to enable Vault to authenticate K8S\nservice accounts.\n\nThe `vault-trust-admin` will be mapped to all Kubernetes Auth Methods with permissions to manage roles \nand to remove the auth method when no longer required.\n\nAfter deploying the Operator, create a [VaultKubeAuth](config/samples/vault_v1alpha1_vaultkubeauth.yaml)\ncustom resource to initialise the trust.\n\n```\napiVersion: vault.controlplane.io/v1alpha1\nkind: VaultKubeAuth\nmetadata:\n  name: vaultkubeauth-sample\nspec:\n  cluster_api_addr: https://kubernetes.default.svc/\n  vault_addr: http://vault.vault.svc:8200/\n  vault_mount_path: k8s/cluster-1\n  vault_mount_admin_policy: vaultkubeauth-cluster1-admin\n  vault_token: s.xxxxxxxxxxxxxxxxxxxxxxxx\n\n```\n\nThis will create the following K8S resources:\n\n*   A configmap containing the templated scripts for managing the Kubernetes Auth Method\n*   A job to configure the Kubernetes Auth Method in Vault\n\nWhen the job has completed the following will be configured in Vault\n\n*   The Kubernetes Auth Method for this cluster\n*   The mapping of the administration policy to the _vault-trust-admin_ service account\n\nWhen the custom resource is deleted, the Kubernetes Auth Method will be removed for this cluster\n\nWith the trust initialised, create [VaultKubeRole](config/samples/vault_v1alpha1_vaultkuberole.yaml) custom\nresources to create roles in Vault for additional service accounts created in the cluster.\n\n```\napiVersion: vault.controlplane.io/v1alpha1\nkind: VaultKubeRole\nmetadata:\n  name: vaultkuberole-sample\nspec:\n  vaultkubeauth_name: vaultkubeauth-sample\n  service_account_name: default\n  service_account_namespace: default\n  policies:\n    - default\n```\n\nWhen the custom resources are deleted, the roles will be removed\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcontrolplaneio%2Fvault-trust-operator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcontrolplaneio%2Fvault-trust-operator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcontrolplaneio%2Fvault-trust-operator/lists"}