https://github.com/phasehq/kubernetes-secrets-operator
Securely sync secrets and environment variables with Phase in your Kubernetes cluster
https://github.com/phasehq/kubernetes-secrets-operator
Last synced: 9 months ago
JSON representation
Securely sync secrets and environment variables with Phase in your Kubernetes cluster
- Host: GitHub
- URL: https://github.com/phasehq/kubernetes-secrets-operator
- Owner: phasehq
- License: gpl-3.0
- Created: 2023-11-16T10:36:37.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2025-08-11T19:26:33.000Z (10 months ago)
- Last Synced: 2025-08-11T21:20:48.199Z (10 months ago)
- Language: Python
- Size: 149 MB
- Stars: 6
- Watchers: 3
- Forks: 1
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Phase Kubernetes Operator
### Securely sync secrets and environment variables with Phase in your Kubernetes cluster.
```
@@@
@@@@@@@@@@
@@@@@@@@@@@@@@@@
P@@@@@&@@@?&@@&@@@@@P
P@@@@# @&@ @P@@@
&@@@# *@& #@@@&
&@@@5 &@? 5@@@&
Y@@@# ^@@ #@@@J
#@@@7 B@5 7@@@#
#@@@? .@@. ?@@@#
@@@@& 5@G &@@@7
#@@@B @@^ #@@@B
B@@@@ .@# 7@@@@B
@@@@@@ &.@ P@@@@@7
@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@
@@@@@@@@
@@@
```
## Features
- Automatically sync secrets to your Kubernetes cluster
- End-to-End encryption
- Automatically redeploy deployments when a secret is updated
- Sync secrets based on environment (dev, staging, prod), folders and tags
- Transform secrets via secret processors
```yaml
metadata:
annotations:
secrets.phase.dev/redeploy: "true"
```
## Installation:
### 1. Install the Operator via Helm
Add the Phase Helm repository and update it:
```fish
helm repo add phase https://helm.phase.dev && helm repo update
```
Install the Phase Secrets Operator:
```fish
helm install phase-secrets-operator phase/phase-kubernetes-operator --set image.tag=v1.0.1
```
It's best practice to specify the version in production environments to avoid
unintended upgrades. Find available versions on our [GitHub
releases](https://github.com/phasehq/kubernetes-secrets-operator/releases).
### 2. Create a Service Token Secret in Kubernetes
Securely create a Service Token Secret using `read` (recommended for more security as it avoids writing the token to disk or shell history)
Run this command, paste the Phase Service Token and hit enter:
```fish
read -s TOKEN
kubectl create secret generic phase-service-token \
--from-literal=token=$TOKEN \
--type=Opaque \
--namespace=default
unset TOKEN
```
Alternatively, create it directly using `kubectl`:
```fish
kubectl create secret generic phase-service-token \
--from-literal=token= \
--type=Opaque \
--namespace=default
```
### 3. Deploy the Phase Secrets Operator CR (Custom Resource)
Create a custom resource file: `phase-secrets-operator-cr.yaml`
```yaml
apiVersion: secrets.phase.dev/v1alpha1
kind: PhaseSecret
metadata:
name: example-phase-secret
namespace: default
spec:
phaseApp: "the-name-of-your-phase-app" # The name of your Phase application
phaseAppEnv: "prod" # OPTIONAL - The Phase application environment to fetch secrets from
phaseHost: "https://console.phase.dev" # OPTIONAL - URL of the Phase Console instance
authentication:
serviceToken:
serviceTokenSecretReference:
secretName: "phase-service-token" # Name of the service token with access to your Phase application
secretNamespace: "default"
managedSecretReferences:
- secretName: "my-application-secret" # Name of the Kubernetes managed secret that Phase will sync
secretNamespace: "default"
```
Deploy the custom resource:
```fish
kubectl apply -f phase-secrets-operator-cr.yaml
```
Watch for `my-application-secret` managed secret being created:
```fish
watch kubectl get secrets
```
View the secrets:
```fish
kubectl get secret my-application-secret -o yaml
```
The operator automatically synchronizes secrets every 60 seconds.
[Phase Kubernetes Operator - Docs](https://docs.phase.dev/integrations/platforms/kubernetes)
## Development:
1. Install python dependencies
```
pip3 install -r requirements.txt
```
2. Create a local kind cluster (skip if you have one already setup)
```fish
kind create cluster
```
3. Export kindconfig
```
kind get kubeconfig --name "kind" > ~/.kube/config
```
Verify that the cluster is up:
```
kubectl get nodes
```
4. Create a copy of the CR (Custom Resource) and CRD (Custom Resource Definition):
```
cp cr-template.yaml dev-cr.yaml
```
```
cp crd-template.yaml dev-crd.yaml
```
Feel free to make changes
5. Create a secret in kubernetes containing the Phase Service Token
```fish
kubectl create secret generic phase-service-token \
--from-literal=token= \
--type=Opaque \
--namespace=default
```
6. Apply the CRD and CR respectively
```fish
kubectl apply -f dev-crd.yaml
```
```fish
kubectl apply -f dev-cr.yaml
```
7. Start the operator via Kopf
```fish
kopf run src/main.py
```