https://github.com/lyafence/chur
Universal Multi-Cloud & Bare-Metal Zero-Trust Secret Injector for Kubernetes.
https://github.com/lyafence/chur
golang k8s kubernetes security
Last synced: 23 days ago
JSON representation
Universal Multi-Cloud & Bare-Metal Zero-Trust Secret Injector for Kubernetes.
- Host: GitHub
- URL: https://github.com/lyafence/chur
- Owner: lyafence
- License: mit
- Created: 2026-06-21T20:17:56.000Z (about 1 month ago)
- Default Branch: main
- Last Pushed: 2026-06-21T23:23:10.000Z (about 1 month ago)
- Last Synced: 2026-06-22T02:07:33.265Z (about 1 month ago)
- Topics: golang, k8s, kubernetes, security
- Language: Go
- Homepage:
- Size: 32.2 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Security: SECURITY.md
- Agents: AGENTS.md
Awesome Lists containing this project
README
# chur
> **Status:** Pre-release. API may change without notice. Not production-ready.
Universal Multi-Cloud & Bare-Metal Zero-Trust Secret Injector for Kubernetes.
## Overview
chur is a Kubernetes admission webhook that intercepts Pod creation and
injects secrets directly into container memory (tmpfs), bypassing etcd, disk,
and environment variables. Secrets are sourced from any backend via a pluggable
provider architecture — AWS Secrets Manager, GCP Secret Manager, Azure Key Vault,
HashiCorp Vault, local files, Kubernetes Secrets, or environment variables.
## Architecture
```
┌──────────────┐
│ API Server │
└──────┬───────┘
│ admission review
┌──────▼───────┐
│ chur-webhook │ ← MutatingWebhookConfiguration
└──────┬───────┘
│ JSON patch: add tmpfs volume + init container
┌──────▼───────┐
│ Pod │
│ ┌──────────┐ │
│ │chur-init │ │ ← reads secret from provider, writes to tmpfs
│ └──────────┘ │
│ ┌──────────┐ │
│ │ app │ │ ← reads secret from tmpfs file
│ └──────────┘ │
└──────────────┘
```
## Providers
| Provider | Backend | Phase |
|------------|----------------------------------|-------|
| `env` | Environment variables (dev) | 1 ✅ |
| `local` | Files on host (bare-metal) | 1 ✅ |
| `k8s` | Kubernetes Secrets (fallback) | 1 ✅ |
| `aws` | AWS Secrets Manager | 2 🚧 |
| `gcp` | GCP Secret Manager | 2 🚧 |
| `azure` | Azure Key Vault | 2 🚧 |
| `vault` | HashiCorp Vault | 2 🚧 |
_Phase 1 providers are implemented and tested. Phase 2 providers are planned._
## Quick Start
```bash
# Build both binaries
make build
# Run tests
make test
# Build Docker images
make docker
```
## Usage
Annotate your Pod with the secret source:
```yaml
apiVersion: v1
kind: Pod
metadata:
name: my-app
annotations:
chur.io/provider: "k8s"
chur.io/secret-ref: "db-credentials"
chur.io/secret-key: "password" # optional: key within the k8s Secret
chur.io/mount-path: "/secrets"
spec:
containers:
- name: app
image: my-app:latest
```
chur-webhook intercepts the Pod, injects an `emptyDir` with `medium: Memory`
and a `chur-init` init container that fetches the secret and writes it to tmpfs.
The application reads the secret from `/secrets/` (e.g. `/secrets/db-credentials`).
See `.env.example` for all supported environment variables.
## License
MIT — see [LICENSE](./LICENSE) for details.