{"id":22998240,"url":"https://github.com/uswitch/vault-webhook","last_synced_at":"2025-07-19T07:06:00.496Z","repository":{"id":34409166,"uuid":"142571159","full_name":"uswitch/vault-webhook","owner":"uswitch","description":"Kubernetes Mutating Webhook to inject Vault-Creds Sidecar into pods","archived":false,"fork":false,"pushed_at":"2025-02-19T12:14:57.000Z","size":4990,"stargazers_count":25,"open_issues_count":0,"forks_count":4,"subscribers_count":9,"default_branch":"master","last_synced_at":"2025-07-05T00:03:35.970Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/uswitch.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2018-07-27T11:53:56.000Z","updated_at":"2025-02-19T12:13:07.000Z","dependencies_parsed_at":"2024-02-02T18:27:09.702Z","dependency_job_id":"294cc552-c6fa-45f9-bb39-5e559c150928","html_url":"https://github.com/uswitch/vault-webhook","commit_stats":null,"previous_names":[],"tags_count":18,"template":false,"template_full_name":null,"purl":"pkg:github/uswitch/vault-webhook","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uswitch%2Fvault-webhook","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uswitch%2Fvault-webhook/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uswitch%2Fvault-webhook/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uswitch%2Fvault-webhook/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/uswitch","download_url":"https://codeload.github.com/uswitch/vault-webhook/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uswitch%2Fvault-webhook/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":265899929,"owners_count":23845878,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-15T06:12:17.050Z","updated_at":"2025-07-19T07:06:00.445Z","avatar_url":"https://github.com/uswitch.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Vault-webhook\nMutating webhook that injects the [Vault-Creds sidecar](https://github.com/uswitch/vault-creds) into pods on pod creation using a custom resource for configuration.\n\n**Note**: `vault-webhook` will only inject sidecar into pods which are in namespace labelled with `vault-webhook=enabled`.\n\n## Usage\nThe webhook will do four things:\n* Add a volume called `vault-creds` this is where you will find your credentials\n* VolumeMount the `vault-creds` volume into your existing containers\n* Add an init-container called `vault-creds-\u003cdatabase-role\u003e-init`\n* Add a container called `vault-creds-\u003cdatabase-role\u003e`\n\nIt does this by checking the service account on your pod against custom resources called DatabaseCredentialBindings.\nThis resource links your ServiceAccount to a Database and role\nExample DatabaseCredentialBinding:\n```yaml\n---\napiVersion: vaultwebhook.uswitch.com/v1alpha1\nkind: DatabaseCredentialBinding\nmetadata:\n  name: mybinding\n  namespace: mynamespace\nspec:\n  serviceAccount: my_service_account\n  database: mydb\n  role: readonly\n  outputPath: /config #Optional: defaults to /etc/database\n  outputFile: mycreds #Optional: defaults to database-role\n```\n\nThe webhook expects there to be a volume called `vault-template` already there, this volume should be a configmap and it should contain a file called `database-role` e.g `mydb-readonly` which will be used for templating your credentials. It will output the credentials to a file called `/etc/database/database-role` in the `vault-creds` volume. Note that the path where the file is found and the name of the file can be changed using the `outputPath` and `outputFile` fields in the CRD respectively.\n\nExample Deployment:\n\n```yaml\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: myapp\n  namespace: mynamespace\nspec:\n  replicas: 1\n  template:\n    metadata:\n    spec:\n      serviceAccountName: my_service_account\n      containers:\n      - name: myapp\n        args:\n        - --db-creds=/etc/database/mydb-readonly\n      volumes:\n      - name: vault-template\n        configMap:\n          name: my-template\n```\n\n## Args\n\n```ShellSession\nusage: vault-webhook-linux-amd64 --vault-address=VAULT-ADDRESS --login-path=LOGIN-PATH --sidecar-image=SIDECAR-IMAGE [\u003cflags\u003e]\n\nFlags:\n  --help                         Show context-sensitive help (also try --help-long and --help-man).\n  --vault-address=VAULT-ADDRESS  URL of vault\n  --vault-ca-path=VAULT-CA-PATH  Path to the CA cert for vault\n  --login-path=LOGIN-PATH        Kubernetes auth login path for vault\n  --sidecar-image=SIDECAR-IMAGE  Vault-creds sidecar image to use\n  --gateway-address=GATEWAY-ADDRESS\n                                 URL of Push Gateway\n  --secret-path-format=\"%s/creds/%s\"\n                                 The format for the path used for reading database credentials, where the first %s is the database name and the second %s is the role\n  --server-address=\":8443\"       The address the webhook server will listen on.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fuswitch%2Fvault-webhook","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fuswitch%2Fvault-webhook","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fuswitch%2Fvault-webhook/lists"}