haopengzhan/k8s-ds-secret-injection
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: implement pod-specific secret injection for DaemonSets with automated lifecycle management

Browse Source
This commit is contained in:
haopengzhan
2026-01-21 06:38:25 +00:00
committed by Pengzhan Hao
commit c6978e24dd
15 changed files with 969 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/secret-manager/README.md
+55
View File
@@ -0,0 +1,55 @@
# Secret Manager
A simple CLI tool to manage Kubernetes Secrets from your local machine. It handles Base64 encoding/decoding automatically, allowing you to work with plain text values.
## Features
- **List**: View all keys and values in a secret (decoded).
- **Add/Update**: Add a new key-value pair or update an existing one using plain text.
- **Delete**: Remove a specific key from a secret.
## Prerequisites
- Local `kubeconfig` file (usually at `~/.kube/config`).
- `cluster-admin` or sufficient RBAC permissions to manage secrets in the target namespace.
## Build
From the root of the repository:
```bash
make build
# The binary will be located at bin/secret-manager
```
## Usage
```bash
./bin/secret-manager --secret <name> [options]
```
### Options
- `--namespace`: Namespace of the secret (default: `default`).
- `--secret`: **(Required)** Name of the Kubernetes secret.
- `--op`: Operation to perform: `list`, `add`, or `delete` (default: `list`).
- `--key`: The key to add or delete.
- `--value`: The plain text value to add (required for `add` operation).
- `--kubeconfig`: Path to a custom kubeconfig file.
### Examples
**1. List keys and values:**
```bash
./bin/secret-manager --namespace gps-system --secret test-daemonset-7v1v1 --op list
```
**2. Add or update a key:**
```bash
./bin/secret-manager --namespace gps-system --secret test-daemonset-7v1v1 --op add --key my-key --value "my-value"
```
**3. Delete a key:**
```bash
./bin/secret-manager --namespace gps-system --secret test-daemonset-7v1v1 --op delete --key my-key
```
cmd/secret-manager/main.go
+101
View File
@@ -0,0 +1,101 @@
package main
import (
"context"
"flag"
"fmt"
"log"
"os"
"path/filepath"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/client-go/kubernetes"
"k8s.io/client-go/tools/clientcmd"
"k8s.io/client-go/util/homedir"
)
func main() {
var kubeconfig *string
if home := homedir.HomeDir(); home != "" {
kubeconfig = flag.String("kubeconfig", filepath.Join(home, ".kube", "config"), "(optional) absolute path to the kubeconfig file")
} else {
kubeconfig = flag.String("kubeconfig", "", "absolute path to the kubeconfig file")
}
var namespace string
var secretName string
var operation string
var key string
var value string
flag.StringVar(&namespace, "namespace", "default", "Namespace of the secret")
flag.StringVar(&secretName, "secret", "", "Name of the secret")
flag.StringVar(&operation, "op", "list", "Operation: add, delete, list")
flag.StringVar(&key, "key", "", "Key for add/delete operation")
flag.StringVar(&value, "value", "", "Value for add operation")
flag.Parse()
if secretName == "" {
fmt.Println("Usage: secret-manager --secret <name> [--namespace <ns>] [--op <add|delete|list>] [--key <k>] [--value <v>]")
os.Exit(1)
}
config, err := clientcmd.BuildConfigFromFlags("", *kubeconfig)
if err != nil {
log.Fatalf("Error building kubeconfig: %v", err)
}
clientset, err := kubernetes.NewForConfig(config)
if err != nil {
log.Fatalf("Error creating clientset: %v", err)
}
ctx := context.TODO()
secret, err := clientset.CoreV1().Secrets(namespace).Get(ctx, secretName, metav1.GetOptions{})
if err != nil {
log.Fatalf("Error getting secret %s/%s: %v", namespace, secretName, err)
}
switch operation {
case "list":
fmt.Printf("Content of secret %s/%s:\n", namespace, secretName)
if len(secret.Data) == 0 {
fmt.Println(" (empty)")
}
for k, v := range secret.Data {
fmt.Printf(" - %s: %s\n", k, string(v))
}
case "add":
if key == "" || value == "" {
log.Fatal("Error: --key and --value are required for 'add' operation")
}
if secret.Data == nil {
secret.Data = make(map[string][]byte)
}
secret.Data[key] = []byte(value)
_, err = clientset.CoreV1().Secrets(namespace).Update(ctx, secret, metav1.UpdateOptions{})
if err != nil {
log.Fatalf("Error updating secret: %v", err)
}
fmt.Printf("Successfully added/updated key '%s' in secret %s/%s\n", key, namespace, secretName)
case "delete":
if key == "" {
log.Fatal("Error: --key is required for 'delete' operation")
}
if _, ok := secret.Data[key]; !ok {
fmt.Printf("Warning: Key '%s' not found in secret %s/%s\n", key, namespace, secretName)
return
}
delete(secret.Data, key)
_, err = clientset.CoreV1().Secrets(namespace).Update(ctx, secret, metav1.UpdateOptions{})
if err != nil {
log.Fatalf("Error updating secret: %v", err)
}
fmt.Printf("Successfully deleted key '%s' from secret %s/%s\n", key, namespace, secretName)
default:
log.Fatalf("Unknown operation: %s. Use list, add, or delete.", operation)
}
}
cmd/test-client/main.go
+51
View File
@@ -0,0 +1,51 @@
package main
import (
"context"
"flag"
"fmt"
"log"
"os"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/client-go/kubernetes"
"k8s.io/client-go/tools/clientcmd"
)
const DefaultKubeletConfigPath = "/var/lib/kubelet/kubeconfig"
func main() {
var namespace string
var secretName string
var kubeconfig string
flag.StringVar(&namespace, "namespace", "", "Namespace of the secret")
flag.StringVar(&secretName, "secret", "", "Name of the secret")
flag.StringVar(&kubeconfig, "kubeconfig", DefaultKubeletConfigPath, "Path to kubeconfig file")
flag.Parse()
if namespace == "" || secretName == "" {
fmt.Println("Usage: test-client --namespace <ns> --secret <name> [--kubeconfig <path>]")
os.Exit(1)
}
config, err := clientcmd.BuildConfigFromFlags("", kubeconfig)
if err != nil {
log.Fatalf("Failed to get node's kubelet config: %v", err)
}
clientset, err := kubernetes.NewForConfig(config)
if err != nil {
log.Fatalf("Failed to create clientset: %v", err)
}
secret, err := clientset.CoreV1().Secrets(namespace).Get(context.TODO(), secretName, metav1.GetOptions{})
if err != nil {
log.Fatalf("Failed to get secret %s/%s: %v", namespace, secretName, err)
}
fmt.Printf("Successfully retrieved secret %s/%s\n", namespace, secretName)
for k, v := range secret.Data {
fmt.Printf("Key: %s, Value: %s\n", k, string(v))
}
}
cmd/webhook/main.go
+191
View File
@@ -0,0 +1,191 @@
package main
import (
"context"
"flag"
"os"
"strings"
"git.pengzhan.dev/k8s-ds-secret-injection/pkg/webhook"
corev1 "k8s.io/api/core/v1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
_ "k8s.io/client-go/plugin/pkg/client/auth"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/healthz"
"sigs.k8s.io/controller-runtime/pkg/log/zap"
webhookadmission "sigs.k8s.io/controller-runtime/pkg/webhook"
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
"sigs.k8s.io/controller-runtime/pkg/metrics/server"
)
var (
scheme = runtime.NewScheme()
setupLog = ctrl.Log.WithName("setup")
)
func init() {
utilruntime.Must(clientgoscheme.AddToScheme(scheme))
// +kubebuilder:scaffold:scheme
}
func main() {
var metricsAddr string
var enableLeaderElection bool
var probeAddr string
var targetNS string
var targetDS string
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
flag.BoolVar(&enableLeaderElection, "leader-election", false,
"Enable leader election for controller manager. "+
"Enabling this will ensure there is only one active controller manager.")
flag.StringVar(&targetNS, "target-namespace", "gps-system", "The namespace to monitor.")
flag.StringVar(&targetDS, "target-daemonsets", "", "Comma-separated list of DaemonSet names to monitor.")
opts := zap.Options{
Development: true,
}
opts.BindFlags(flag.CommandLine)
flag.Parse()
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
Scheme: scheme,
Metrics: server.Options{
BindAddress: metricsAddr,
},
WebhookServer: webhookadmission.NewServer(webhookadmission.Options{
Port: 9443,
}),
HealthProbeBindAddress: probeAddr,
LeaderElection: enableLeaderElection,
LeaderElectionID: "inject-ds-lock",
})
if err != nil {
setupLog.Error(err, "unable to start manager")
os.Exit(1)
}
dsList := strings.Split(targetDS, ",")
for i := range dsList {
dsList[i] = strings.TrimSpace(dsList[i])
}
// Register Webhook
hookServer := mgr.GetWebhookServer()
setupLog.Info("registering mutating webhook")
decoder := admission.NewDecoder(scheme)
mutator := &webhook.PodMutator{
Client: mgr.GetClient(),
TargetNS: targetNS,
TargetDSList: dsList,
}
mutator.InjectDecoder(decoder)
hookServer.Register("/mutate-pod", &admission.Webhook{
Handler: mutator,
})
// Add a simple controller to cleanup secrets when pods are deleted
if err := (&PodController{
Client: mgr.GetClient(),
TargetNS: targetNS,
}).SetupWithManager(mgr); err != nil {
setupLog.Error(err, "unable to create controller", "controller", "Pod")
os.Exit(1)
}
if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
setupLog.Error(err, "unable to set up health check")
os.Exit(1)
}
if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
setupLog.Error(err, "unable to set up ready check")
os.Exit(1)
}
setupLog.Info("starting manager")
if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
setupLog.Error(err, "problem running manager")
os.Exit(1)
}
}
// PodController watches Pods and deletes associated secrets on deletion
type PodController struct {
client.Client
TargetNS string
}
func (r *PodController) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
log := ctrl.Log.WithValues("pod", req.NamespacedName)
if req.Namespace != r.TargetNS {
return ctrl.Result{}, nil
}
pod := &corev1.Pod{}
err := r.Get(ctx, req.NamespacedName, pod)
if err != nil {
if !apierrors.IsNotFound(err) {
return ctrl.Result{}, err
}
// Pod is already gone. We try to delete the secret just in case.
secret := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: req.Name,
Namespace: req.Namespace,
},
}
if err := r.Delete(ctx, secret); err != nil && !apierrors.IsNotFound(err) {
return ctrl.Result{}, err
}
return ctrl.Result{}, nil
}
// If pod is marked for deletion, cleanup secret and remove finalizer
if !pod.DeletionTimestamp.IsZero() {
log.Info("Pod deleting, cleaning up associated secret")
secret := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: pod.Name,
Namespace: pod.Namespace,
},
}
if err := r.Delete(ctx, secret); err != nil && !apierrors.IsNotFound(err) {
return ctrl.Result{}, err
}
// Remove finalizer
newFinalizers := []string{}
changed := false
for _, f := range pod.Finalizers {
if f == "inject-ds-webhook.example.com/cleanup" {
changed = true
continue
}
newFinalizers = append(newFinalizers, f)
}
if changed {
pod.Finalizers = newFinalizers
if err := r.Update(ctx, pod); err != nil {
return ctrl.Result{}, err
}
}
}
return ctrl.Result{}, nil
}
func (r *PodController) SetupWithManager(mgr ctrl.Manager) error {
return ctrl.NewControllerManagedBy(mgr).
For(&corev1.Pod{}).
Complete(r)
}