keeper/injector-sidecar repository overview

⁠Keeper Secrets Injector - Sidecar

The sidecar container component of the Keeper Kubernetes Secrets Injector.

⁠What This Does

This container runs alongside your application and:

• Fetches secrets from Keeper Secrets Manager at pod startup
• Writes secrets to a shared tmpfs volume (memory-only, never touches disk)
• Continuously refreshes secrets at configurable intervals
• Optionally sends signals (e.g., SIGHUP) to your app when secrets update

⁠Usage

This image is automatically injected into your pods by the webhook. You don't typically pull this image directly.

⁠Enable Injection

Add annotations to your pod:

apiVersion: v1
kind: Pod
metadata:
  name: my-app
  annotations:
    keeper.security/inject: "true"
    keeper.security/auth-secret: "keeper-auth"
    keeper.security/secret: "database-credentials"
spec:
  containers:
    - name: app
      image: my-app:latest

⁠Secrets Location

Secrets are written to /keeper/secrets/ by default:

• /keeper/secrets/database-credentials.json

⁠Architecture

┌─────────────────────────────────────────┐
│                  Pod                    │
│  ┌─────────────┐    ┌─────────────────┐ │
│  │  Your App   │    │ injector-sidecar│ │ ◄── This image
│  │             │    │                 │ │
│  │  Reads from │◄───│ Writes secrets  │ │
│  │  /keeper/   │    │ from KSM        │ │
│  └─────────────┘    └─────────────────┘ │
│         ▲                   │           │
│         └───────────────────┘           │
│              tmpfs volume               │
└─────────────────────────────────────────┘

⁠Features

• Memory-only storage - Secrets never written to disk
• Auto-rotation - Refreshes secrets without pod restart
• Signal support - Notify your app when secrets change
• Keeper Notation - Extract specific fields with keeper://UID/field/password
• File attachments - Download files from Keeper records

⁠Configuration Annotations

⁠Links

• GitHub Repository⁠
• Annotations Reference⁠
• Keeper Secrets Manager⁠

⁠Tags

• latest - Latest stable release
• X.Y.Z - Specific version (e.g., 0.1.2)

⁠License

MIT License - Keeper Security, Inc.⁠