kubernetes-external-secrets

They probably should merge with https://github.com/external-secrets/kubernetes-external-secr...

The entire Kubernetes secret space is a bit immature with no standard solutions. Many of the larger solutions are vendor specific and don't solve the problem in a generic way, see AWS[1] or Vault[2][3]. I've been discussing the problem-space with the Godaddy External Secret maintainers and they seem a bit burnt-out. There is work on standardization here https://github.com/godaddy/kubernetes-external-secrets/pull/..., but this more covers creating Kubernetes Secrets from external sources, work still remains around a generic pod injector solution. A few of us have started work on what the implementation of this would look like over at https://github.com/itscontained/secret-manager. [1] https://github.com/mumoshu/aws-secret-operator [2] https://github.com/hashicorp/vault-k8s [3] https://banzaicloud.com/blog/inject-secrets-into-pods-vault-...

Yeah, we should probably include in Github readme, but the itscontained/secret-manager is an implementation of the standardization that a few of us have been working on in https://github.com/godaddy/kubernetes-external-secrets/pull/.... There has been talks of moving one of these solutions to https://github.com/external-secrets ownership, but nothing has happened around that yet.

I will run the risk of sounding condescending here, but I sense some negativity in your comment that I fail to find a justification for. People need solutions to their problems and they develop them asynchronously and in isolation from each other. Turns out that some problems are more universal than others and could benefit from a common effort. Suddenly, solutions collide and collaboration happens. What you describe is exactly what they are trying to do now: https://github.com/godaddy/kubernetes-external-secrets/pull/... So, rejoice! The magic of open source and internet enabled collaboration is happening right before your eyes! :)

I am the founder of a very similar project that supports both AWS Secrets Manager and Google Secrets Manager which actually predates this and GoDaddy's solutions[1]. The proliferation of these type of projects clearly shows the need for secret handling. While I think that more solutions for the same problem is not a bad thing, I also believe that we could benefit from a coordinated effort. My colleagues are actively working with GoDaddy's maintainers to find a common way forward by standardizing the "ExternalSecret" CRD and eventually merging the projects[2]. [1]https://github.com/ContainerSolutions/externalsecret-operato... [2]https://github.com/godaddy/kubernetes-external-secrets/issue...

I could be wrong; I had originally started using "external-secrets" then I believe found about "secret-manager" from the Godaddy repository. I've used both solutions, and ultimately, I think itscontained/secret-manager is better than external-secrets. Their doc was re-jiggled a few days ago and I agree its made it look like it's inexistant. There's not a _ton_ of it, but it's there[0][1] [0]https://github.com/itscontained/secret-manager/tree/master/d... [1]https://github.com/itscontained/secret-manager/blob/master/d... edit: found the link in the Godaddy repo to "secret-manager": https://github.com/godaddy/kubernetes-external-secrets/issue... I was mistaken when I said "secret-manager supplanted external-secrets". It's a Golang rewrite from a user.

Seems like the article author doesn't like it much, but GoDaddy's Kubernetes External Secrets seems to support Google Secrets Manager: https://github.com/godaddy/kubernetes-external-secrets

It's worth noting that the "Kubernetes External Secrets"[0] project from Godaddy is now supplanted by "Secret-Manager"[1]. I've been using Secret-Manager and it works very well. The authors of "kube-secret-syncer" mention "[other solutions] lack either in security, caching or flexibility". When it comes to "secret-manager", although I can not vouch for its security, the codebase is very small and probably easily auditable. It's also very flexible. It supports "SecretStores", currently AWS, GCP and Vault out of the box, and it's easy to add more. Not sure why "caching" is mentioned in the mix. I'm surprised they decided to re-invent the wheel instead of improving secret-manager. [0]: https://github.com/godaddy/kubernetes-external-secrets [1]: https://github.com/itscontained/secret-manager

This bit us too. We use goodaddy's external secrets [1] to fetch secrets from AWS secrets manager and make them available to the cluster. It polls the secret every n seconds, but with many services consuming secrets, it can scale up pretty quickly and start to build up cost. [1] https://github.com/godaddy/kubernetes-external-secrets

I don't think they were aware, but someone pointed it out in this issue: https://github.com/godaddy/kubernetes-external-secrets/issue...

Hey, thanks for the feedback and great suggestion. Made an issue to track on github: https://github.com/godaddy/kubernetes-external-secrets/issue...