search

aws-samples / aws-secret-sidecar-injector

Kubernetes mutating webhook to fetch secrets from AWS Secrets Manager
MIT No Attribution
145 stars 35 forks source link

Changing mount point and ecrousseau/aws-secret-injector fork. #36

Closed darnone closed 3 years ago

darnone commented 4 years ago

Hello,

I am trying to make use of this. I am able to get the implementation from master to stand up. But I have a couple of questions. Is it possible to the mount point point to something other then /tmp/secret. Is it possible to mount secret-vol directly in a pod? Also, in a regular kubernetes secret, each secret value is placed in a file with the key as the name of the file. /tmp/secret is not formated. I have a container that is looking for secrets ala regular kubernetes secret format.

The fork at ecrousseau/aws-secret-injector does is closer to what we are looking for. But I cannot get it to stand up. First the webhook name in the chart template webhook.yaml is secret-inject. Deploying that helm chart results in error: Error: MutatingWebhookConfiguration.admissionregistration.k8s.io "secret-inject" is invalid: webhooks[0].name: Invalid value: "secret-inject": should be a domain with at least three segments separated by dots

so I changed wehhook name from secret-inject to secret-inject.aws.amazon.com. The webhook deploys but the deployment fails to create the test pod.k get deployments.apps NAME READY UP-TO-DATE AVAILABLE AGE secret-inject 1/1 1 1 117s secrets-testing 0/1 0 0 70s

jicowan commented 4 years ago

@darnone you will likely need to contact @ecrousseau about their fork and how to install it. I will also consider changing the file name from "secret" to the name of the secret in AWS Secrets manager.
I am not sure what you mean by mounting secret-vol directly into a pod. The secret is written to a volume that is shared between the application container and the init container. You can change the path easily enough, but the secret has to be written to a location accessible to the init and application containers.

ecrousseau commented 3 years ago

Hi @darnone - I've fixed that invalid name in the helm chart for my fork - thanks! Please raise an issue over there if you need any further help using that particular version.

In regard to your question about mounting secrets in a different location - my fork allows you do that by explicitly adding "secret-vol" to your deployment rather than letting the mutating webhook add it for you. Your pod template can then mount that volume in whatever location you like.

jicowan commented 3 years ago

The ability to specify the mount and secret file name are in the latest PR.