{"id":51298910,"url":"https://github.com/lyafence/chur","last_synced_at":"2026-06-30T17:30:28.106Z","repository":{"id":366461422,"uuid":"1276309686","full_name":"lyafence/chur","owner":"lyafence","description":"Universal Multi-Cloud \u0026 Bare-Metal Zero-Trust Secret Injector for Kubernetes.","archived":false,"fork":false,"pushed_at":"2026-06-21T23:23:10.000Z","size":33,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-22T02:07:33.265Z","etag":null,"topics":["golang","k8s","kubernetes","security"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lyafence.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-06-21T20:17:56.000Z","updated_at":"2026-06-21T23:23:14.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/lyafence/chur","commit_stats":null,"previous_names":["lyafence/chur"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/lyafence/chur","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lyafence%2Fchur","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lyafence%2Fchur/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lyafence%2Fchur/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lyafence%2Fchur/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lyafence","download_url":"https://codeload.github.com/lyafence/chur/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lyafence%2Fchur/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34977666,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-30T02:00:05.919Z","response_time":92,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["golang","k8s","kubernetes","security"],"created_at":"2026-06-30T17:30:27.220Z","updated_at":"2026-06-30T17:30:28.071Z","avatar_url":"https://github.com/lyafence.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# chur\n\n\u003e **Status:** Pre-release. API may change without notice. Not production-ready.\n\n![Status](https://img.shields.io/badge/status-pre--release-red)\n\nUniversal Multi-Cloud \u0026 Bare-Metal Zero-Trust Secret Injector for Kubernetes.\n\n## Overview\n\nchur is a Kubernetes admission webhook that intercepts Pod creation and\ninjects secrets directly into container memory (tmpfs), bypassing etcd, disk,\nand environment variables. Secrets are sourced from any backend via a pluggable\nprovider architecture — AWS Secrets Manager, GCP Secret Manager, Azure Key Vault,\nHashiCorp Vault, local files, Kubernetes Secrets, or environment variables.\n\n## Architecture\n\n```\n                         ┌──────────────┐\n                         │  API Server   │\n                         └──────┬───────┘\n                                │ admission review\n                         ┌──────▼───────┐\n                         │ chur-webhook │  ← MutatingWebhookConfiguration\n                         └──────┬───────┘\n                                │ JSON patch: add tmpfs volume + init container\n                         ┌──────▼───────┐\n                         │    Pod        │\n                         │ ┌──────────┐ │\n                         │ │chur-init │ │  ← reads secret from provider, writes to tmpfs\n                         │ └──────────┘ │\n                         │ ┌──────────┐ │\n                         │ │  app     │ │  ← reads secret from tmpfs file\n                         │ └──────────┘ │\n                         └──────────────┘\n```\n\n## Providers\n\n| Provider   | Backend                          | Phase |\n|------------|----------------------------------|-------|\n| `env`      | Environment variables (dev)      | 1 ✅  |\n| `local`    | Files on host (bare-metal)       | 1 ✅  |\n| `k8s`      | Kubernetes Secrets (fallback)    | 1 ✅  |\n| `aws`      | AWS Secrets Manager              | 2 🚧  |\n| `gcp`      | GCP Secret Manager               | 2 🚧  |\n| `azure`    | Azure Key Vault                  | 2 🚧  |\n| `vault`    | HashiCorp Vault                  | 2 🚧  |\n\n_Phase 1 providers are implemented and tested. Phase 2 providers are planned._\n\n## Quick Start\n\n```bash\n# Build both binaries\nmake build\n\n# Run tests\nmake test\n\n# Build Docker images\nmake docker\n```\n\n## Usage\n\nAnnotate your Pod with the secret source:\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: my-app\n  annotations:\n    chur.io/provider: \"k8s\"\n    chur.io/secret-ref: \"db-credentials\"\n    chur.io/secret-key: \"password\"   # optional: key within the k8s Secret\n    chur.io/mount-path: \"/secrets\"\nspec:\n  containers:\n    - name: app\n      image: my-app:latest\n```\n\nchur-webhook intercepts the Pod, injects an `emptyDir` with `medium: Memory`\nand a `chur-init` init container that fetches the secret and writes it to tmpfs.\nThe application reads the secret from `/secrets/\u003cref\u003e` (e.g. `/secrets/db-credentials`).\n\nSee `.env.example` for all supported environment variables.\n\n## License\n\nMIT — see [LICENSE](./LICENSE) for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flyafence%2Fchur","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flyafence%2Fchur","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flyafence%2Fchur/lists"}