{"id":29132307,"url":"https://github.com/expediagroup/secrets-injector","last_synced_at":"2025-08-30T18:19:05.925Z","repository":{"id":119158053,"uuid":"214145683","full_name":"ExpediaGroup/secrets-injector","owner":"ExpediaGroup","description":null,"archived":false,"fork":false,"pushed_at":"2024-03-05T05:26:04.000Z","size":45,"stargazers_count":9,"open_issues_count":7,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-08-21T03:20:08.455Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ExpediaGroup.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE-OF-CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2019-10-10T09:47:46.000Z","updated_at":"2021-04-19T10:53:07.000Z","dependencies_parsed_at":"2023-07-10T01:15:58.901Z","dependency_job_id":null,"html_url":"https://github.com/ExpediaGroup/secrets-injector","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/ExpediaGroup/secrets-injector","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ExpediaGroup%2Fsecrets-injector","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ExpediaGroup%2Fsecrets-injector/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ExpediaGroup%2Fsecrets-injector/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ExpediaGroup%2Fsecrets-injector/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ExpediaGroup","download_url":"https://codeload.github.com/ExpediaGroup/secrets-injector/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ExpediaGroup%2Fsecrets-injector/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":272886550,"owners_count":25009850,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-30T02:00:09.474Z","response_time":77,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-30T06:39:09.345Z","updated_at":"2025-08-30T18:19:05.920Z","avatar_url":"https://github.com/ExpediaGroup.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Secrets Injector\n\nUses a mutating webhook to create an `initContainer` within an annotated pod \n\nThe mutatingwebhook configuration limits to an annotated namespace \n\nThe `initContainer` can be of any secret image as desired, but the examples folder gives a simple python\nscript for AWS\n\nThe image names are overridden in the helm chart supplied and the command and args to fire are also configurable\n\nThe mount point of the secrets obtained is configurable and is mounted as an in-memory volume from the `initContainer`\nto the `Volumes` in the pod to be injected.\n\n\nAcknowledgments to: https://banzaicloud.com/blog/k8s-admission-webhooks/\n\n# Kubernetes Admission Webhook example\n\nThis tutorial shows how to build and deploy an [AdmissionWebhook](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#admission-webhooks).\n\n## Building\n\n### Build the go binary `secrets-injector` \n`make go-build`\n\n### Package the secrets injector binary into a docker image \n`make docker-injector-build`\n`make docker-injector-build INJECTOR_TAG=myrepotag`\n\n### Package the example aws secret reader into a docker image \n`make docker-secret-build`\n`make docker-secret-build SECRET_TAG=myrepotag`\n\n### Push to docker repo\n`make docker-push INJECTOR_TAG=myrepotag SECRET_TAG=myrepotag`\n\n### Helm install\n`make helm-install INJECTOR_TAG=myrepotag SECRET_TAG=myrepotag`\nPut any additional overrides in overrides.yaml in helm folder\n\n### All\n`make all INJECTOR_TAG=myrepotag SECRET_TAG=myrepotag`\n\n## Setup\n\n### Decorate namespace with a label\n\n`kubectl label namespace default expediagroup.com/secrets-injector=enabled`\n\nThis is overridable in the helm chart if necessary `namespaceSelector: mylabel`\n\n### Add pod labels\n\n`expediagroup.com/secrets-injector-format: yaml`\n`expediagroup.com/secrets-injector-key: my-secret-key`\n\n### Create IAM role/policies/trust\n\n### IAM Role Example Policy\n```\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Action\": [\n                \"secretsmanager:*\"\n            ],\n            \"Resource\": \"*\",\n            \"Effect\": \"Allow\"\n        }\n    ]\n}\n```\n\n### IAM Role Example Trust\n```\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"Service\": \"secretsmanager.amazonaws.com\"\n      },\n      \"Action\": \"sts:AssumeRole\"\n    },\n    {\n      \"Sid\": \"\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::000000000000:role/eks-worker-role\"\n      },\n      \"Action\": \"sts:AssumeRole\"\n    }\n  ]\n}\n```\n\n\n## Installation\n\n### Use helm chart to create the manifests either via helm install or template\n\n`helm install -n myrelease --set image.pullPolicy=Never --set image.repository=myrepo helm/secrets-injector`\n\n- helm install will automatically build certs/ca and create mountable secrets\n- helm overrides will allow launch of a specified image for both the webhook and the secret reading process\n\n### Override aws secret and/or region with helm values\n\n```\naws:\n  secret:\n    key: my-key\n  region: us-west-2\n```\n\n## Debugging\n\n### Examine events\n`kubectl get events` to check\n\n### Create a sample set of pods (sleep.yaml is in examples/ folder)\n\n```\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: sleep\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: sleep\n  template:\n    metadata:\n      annotations:\n        iam.amazonaws.com/role: arn:aws:iam::000000000000:role/my-secret-role\n      labels:\n        expediagroup.com/secrets-injector-format: yaml\n        expediagroup.com/secrets-injector-key: s-eg-platform\n        app: sleep\n    spec:\n      containers:\n      - name: sleep\n        image: tutum/curl\n        command: [\"/bin/sleep\",\"infinity\"]\n        imagePullPolicy: IfNotPresent\n```\n\n### Then check the resultant pod by\n\n`kubectl exec sleep-xxx cat /secrets/secret.yaml`\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fexpediagroup%2Fsecrets-injector","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fexpediagroup%2Fsecrets-injector","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fexpediagroup%2Fsecrets-injector/lists"}