keeper-k8s-injector

module

v0.1.0 Latest Latest Go to latest Published: Jan 15, 2026 License: MIT

README ¶

Keeper Kubernetes Secrets Injector

Automatically inject secrets from Keeper Secrets Manager into your Kubernetes pods at runtime.

Features

No Kubernetes Secrets created - Secrets are written directly to pod tmpfs
Pod-scoped lifetime - Secrets are removed when pod terminates
Automatic rotation - Sidecar refreshes secrets without pod restarts
Simple configuration - Just two annotations to get started
Title-based lookup - Reference secrets by name, not UIDs
Keeper Notation - Use keeper://UID/field/password for precise extraction
File Attachments - Download files from Keeper records
Folder Support - Fetch all secrets from a Keeper folder
Production-ready - HA, metrics, leader election

Quick Start

Install

kubectl apply -f https://keeper.security/k8s/injector.yaml

Configure Auth

kubectl create secret generic keeper-auth --from-file=config=ksm-config.json

Annotate Your Pod

apiVersion: v1
kind: Pod
metadata:
  name: my-app
  annotations:
    keeper.security/inject: "true"
    keeper.security/auth-secret: "keeper-auth"
    keeper.security/secret: "database-credentials"
spec:
  containers:
    - name: app
      image: my-app:latest

That's it! Your secrets are now available at /keeper/secrets/database-credentials.json.

Documentation

Overview - Architecture and concepts
Quick Start - 5-minute setup guide
Annotations Reference - All configuration options
Advanced Configuration - Helm, OIDC, multi-cluster
Troubleshooting - Common issues and solutions

Annotation Examples

Multiple Secrets

keeper.security/secrets: "database-creds, api-keys, tls-cert"

Custom Paths

keeper.security/secret-db: "/app/config/database.json"
keeper.security/secret-api: "/etc/myapp/api.json"

With Rotation

keeper.security/refresh-interval: "5m"
keeper.security/signal: "SIGHUP"

Keeper Notation (Specific Fields)

keeper.security/secret-password: "keeper://QabbPIdM8Unw4hwVM-F8VQ/field/password:/app/secrets/db-pass"

File Attachments

keeper.security/file-cert: "Database Credentials:cert.pem:/app/certs/server.pem"

Comparison with ESO

Feature	Keeper Injector	External Secrets Operator
Creates K8s Secrets	No	Yes
Secret storage	Pod tmpfs	etcd
Configuration	Annotations	CRDs
Runtime rotation	Yes (sidecar)	Sync interval

Requirements

Kubernetes 1.25+
cert-manager (for TLS)
Keeper Secrets Manager application

Contributing

Contributions are welcome! Please read our Contributing Guide.

License

MIT License - see LICENSE for details.

Support

Directories ¶

Path	Synopsis
cmd
sidecar command Package main is the entry point for the Keeper sidecar agent.	Package main is the entry point for the Keeper sidecar agent.
webhook command Package main is the entry point for the Keeper webhook controller.	Package main is the entry point for the Keeper webhook controller.
pkg
config Package config handles parsing and validation of Keeper injection annotations.	Package config handles parsing and validation of Keeper injection annotations.
ksm Package ksm provides a wrapper around the Keeper Secrets Manager Go SDK.	Package ksm provides a wrapper around the Keeper Secrets Manager Go SDK.
metrics Package metrics provides Prometheus metrics for the Keeper K8s Injector.	Package metrics provides Prometheus metrics for the Keeper K8s Injector.
sidecar Package sidecar implements the secrets agent that runs as init container or sidecar.	Package sidecar implements the secrets agent that runs as init container or sidecar.
webhook Package webhook implements the Kubernetes mutating admission webhook for secret injection.	Package webhook implements the Kubernetes mutating admission webhook for secret injection.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL