aws-secret-sidecar-injector
aws-secret-sidecar-injector copied to clipboard
aws-samples
Feature request - support multiple Secrets injection
As much as I can tell, Currently, We can inject one secret only using secrets.k8s.aws/secret-arn .
Would be nice to inject multiple secrets into a given pod.
That's right. There is a fork of this project that supports multiple secrets.
Thanks for the fast response!
Would you mind sharing it? Any estimation time on when this change will be merged?
See the aws-samples:multi-secret branch. There are no plans to merge it at the moment.
It's quite a fundamental bit of functionality :"requesting more than one secret".
I've been testing the multi-secret branch. Bit of a faff trying to get things working, due to the gitpages.io repo not serving the updated charts.
This Feature is really important in case of injecting my certificate and my key to my nginx pod
wonderful and easy to use tool, but indeed, a multi-secret feature would help a lot
See the aws-samples:multi-secret branch. There are no plans to merge it at the moment.
@jicowan I am using this project in production. And it's often asked to support multiple secrets. So I was wondering as to why wouldn't you support/merge the muti-secret fork?
@bjethwan I think it might be related with the recommendation to use the just release ASCP project, as describe in this project's README.
https://aws.amazon.com/blogs/security/how-to-use-aws-secrets-configuration-provider-with-kubernetes-secrets-store-csi-driver/
You can give it a try, it seems to work just fine within our EKS implementation
@adriantaut CSI driver is cool (I was in loop with CSI driver pm team) but it doesn't fit the design of my k8s based platform. Further, the cost ($) of the poll-based rotation-reconciler is bothering.
@bjethwan ah ok, wondering why it does not fit it. I think you can disable the reconciler
@bjethwan @adriantaut The cost of polling is pretty negligible ($0.05 per 10,000 API calls) and you can configure the polling interval or disable it all together. We are not supporting the multi-secret branch because it is a complete re-write of the sidecar/admission controller and we're not prepared to support it. We were hoping the contributor would maintain it, but that has not come to pass.
We ended up writing our own service to support this request, I can share the source code if interested.
We ended up writing our own service to support this request, I can share the source code if interested.
sure @AmitBaranes I would be interested
We ended up writing our own service to support this request, I can share the source code if interested.
@AmitBaranes - Also interested, looking at keeping secrets out of k8s "secrets" objects, but still utilize k8s IRSA
