Something went wrong. Try again.
A Kubernetes operator that bridges Hardware Security Module (HSM) data storage with Kubernetes Secrets, providing true secret portability th
Something went wrong. Try again.
8.0 kB · 382 lines
YAML
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382# Complete HSM Secrets Operator Setup Example# This file demonstrates a full deployment with all components
---# Namespace for the operatorapiVersion: v1kind: Namespacemetadata: name: hsm-secrets-operator-system labels: control-plane: controller-manager app.kubernetes.io/name: hsm-secrets-operator app.kubernetes.io/version: v1.0.0
---# HSM Device ConfigurationapiVersion: hsm.j5t.io/v1alpha1kind: HSMDevicemetadata: name: production-hsm namespace: hsm-secrets-operator-system labels: environment: production device-type: pico-hsmspec: deviceType: PicoHSM # Discovery configuration discovery: usb: - vendorId: "20a0" productId: "4230" # PKCS#11 configuration pkcs11: libraryPath: "/usr/lib/opensc-pkcs11.so" slotId: 0 pinSecret: name: "production-hsm-pin" key: "pin" tokenLabel: "PicoHSM" nodeSelector: hsm.j5t.io/enabled: "true" maxDevices: 2
---# Production Database SecretapiVersion: hsm.j5t.io/v1alpha1kind: HSMSecretmetadata: name: production-database namespace: production labels: app: webapp type: database criticality: highspec: # HSM path is automatically set to the metadata.name (production-database) parentRef: name: controller-manager namespace: hsm-secrets-operator-system secretName: "webapp-database-credentials" autoSync: true syncInterval: 600 # 10 minutes secretType: Opaque
---# TLS Certificate SecretapiVersion: hsm.j5t.io/v1alpha1kind: HSMSecretmetadata: name: webapp-tls namespace: production labels: app: webapp type: tlsspec: # HSM path is automatically set to the metadata.name (webapp-tls) parentRef: name: controller-manager namespace: hsm-secrets-operator-system secretName: "webapp-tls-cert" autoSync: true syncInterval: 3600 # 1 hour secretType: kubernetes.io/tls
---# Production NamespaceapiVersion: v1kind: Namespacemetadata: name: production labels: environment: production hsm.j5t.io/enabled: "true"
---# Web Application DeploymentapiVersion: apps/v1kind: Deploymentmetadata: name: webapp namespace: production labels: app: webapp version: v1.0.0spec: replicas: 3 strategy: type: RollingUpdate rollingUpdate: maxUnavailable: 1 maxSurge: 1 selector: matchLabels: app: webapp template: metadata: labels: app: webapp version: v1.0.0 spec: # Pod anti-affinity for high availability affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: labelSelector: matchExpressions: - key: app operator: In values: - webapp topologyKey: kubernetes.io/hostname containers: - name: webapp image: nginx:1.21-alpine ports: - containerPort: 8080 name: http # Use HSM-backed secrets env: - name: DATABASE_URL valueFrom: secretKeyRef: name: webapp-database-credentials key: database_url - name: DB_USERNAME valueFrom: secretKeyRef: name: webapp-database-credentials key: username - name: DB_PASSWORD valueFrom: secretKeyRef: name: webapp-database-credentials key: password # Mount TLS certificate volumeMounts: - name: tls-certs mountPath: /etc/ssl/certs/webapp readOnly: true # Health checks livenessProbe: httpGet: path: /health port: 8080 scheme: HTTP initialDelaySeconds: 30 periodSeconds: 10 timeoutSeconds: 5 readinessProbe: httpGet: path: /ready port: 8080 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 5 timeoutSeconds: 3 resources: requests: cpu: 100m memory: 128Mi limits: cpu: 500m memory: 512Mi securityContext: runAsNonRoot: true runAsUser: 1000 allowPrivilegeEscalation: false capabilities: drop: - ALL volumes: - name: tls-certs secret: secretName: webapp-tls-cert securityContext: fsGroup: 2000
---# Service for the web applicationapiVersion: v1kind: Servicemetadata: name: webapp-service namespace: production labels: app: webappspec: selector: app: webapp ports: - port: 80 targetPort: 8080 name: http type: ClusterIP
---# Ingress with TLSapiVersion: networking.k8s.io/v1kind: Ingressmetadata: name: webapp-ingress namespace: production labels: app: webapp annotations: nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/force-ssl-redirect: "true"spec: tls: - hosts: - webapp.example.com secretName: webapp-tls-cert # HSM-backed TLS certificate rules: - host: webapp.example.com http: paths: - path: / pathType: Prefix backend: service: name: webapp-service port: number: 80
---# Horizontal Pod AutoscalerapiVersion: autoscaling/v2kind: HorizontalPodAutoscalermetadata: name: webapp-hpa namespace: productionspec: scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: webapp minReplicas: 3 maxReplicas: 10 metrics: - type: Resource resource: name: cpu target: type: Utilization averageUtilization: 70 - type: Resource resource: name: memory target: type: Utilization averageUtilization: 80
---# Pod Disruption BudgetapiVersion: policy/v1kind: PodDisruptionBudgetmetadata: name: webapp-pdb namespace: productionspec: minAvailable: 2 selector: matchLabels: app: webapp
---# Network Policy for production environmentapiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata: name: webapp-network-policy namespace: productionspec: podSelector: matchLabels: app: webapp policyTypes: - Ingress - Egress ingress: - from: - namespaceSelector: matchLabels: name: ingress-nginx ports: - protocol: TCP port: 8080 egress: - to: - namespaceSelector: {} ports: - protocol: TCP port: 5432 # Database - protocol: TCP port: 443 # HTTPS - protocol: UDP port: 53 # DNS
---# RBAC for production applicationsapiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata: namespace: production name: webapp-secrets-readerrules:- apiGroups: [""] resources: ["secrets"] verbs: ["get", "list"]- apiGroups: ["hsm.j5t.io"] resources: ["hsmsecrets"] verbs: ["get", "list", "watch"]
---apiVersion: rbac.authorization.k8s.io/v1kind: RoleBindingmetadata: name: webapp-secrets-access namespace: productionsubjects:- kind: ServiceAccount name: default namespace: productionroleRef: kind: Role name: webapp-secrets-reader apiGroup: rbac.authorization.k8s.io
---# Monitoring: ServiceMonitor for PrometheusapiVersion: monitoring.coreos.com/v1kind: ServiceMonitormetadata: name: hsm-operator-metrics namespace: hsm-secrets-operator-system labels: app: hsm-secrets-operatorspec: selector: matchLabels: control-plane: controller-manager endpoints: - port: https path: /metrics scheme: https bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token tlsConfig: insecureSkipVerify: true