Skip to content

Commit 33a1381

Browse files
SoulKyuSoulKyu
authored
Merge pull request #13 from numberly/documentation-comparison-and-fix
Documentation comparison and fix
2 parents f350878 + 1c18ffb commit 33a1381

File tree

14 files changed

+80
-144
lines changed

14 files changed

+80
-144
lines changed

‎README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ Checkout the [Vault DB Injector documentation](https://numberly.github.io/vault-
1616

1717
Contributions to the vault-db-injector are welcome. Please submit your pull requests or issues to the project's GitLab repository.
1818

19+
## 4. <a name='Tool Comparison'></a>Projects Comparison
20+
21+
Here you can find a comparison with many vault injector projects : [Comparaison](https://numberly.github.io/vault-db-injector/getting-started/comparison/)
1922

2023
## 5. <a name='Acknowledgements'></a>Acknowledgements
2124

‎docs/getting-started/comparison.md

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# Comparison
2+
3+
A vault injector retrieves credentials from a vault database engine and injects them into pods' environment variables. This document compares different existing tools with the new vault injector being developed.
4+
5+
## Summary
6+
7+
## 1. <a name='WhyVault-Db-Injector'></a>Why Vault-Db-Injector?
8+
9+
Before comparing Vault-Db-Injector with existing tools, we would like to share that we initially investigated various vault injector solutions designed to fetch credentials from Vault.
10+
11+
After extensive research, we found no tools that matched our needs, and most of them were difficult to contribute to.
12+
13+
Vault-Db-Injector is not a replacement for any existing vault injector but a tool more focused on security and the database engine.
14+
15+
We didn't intend to reinvent the wheel but designed a tool that perfectly matches our needs and shared it with those who might be interested.
16+
17+
## 2. <a name='ToolsComparison'></a>Tools Comparison
18+
19+
Here are the major tools that we compare our injector to:
20+
21+
- [Vault Agent Injector](https://developer.hashicorp.com/vault/docs/platform/k8s/injector)
22+
- [Bank Vault](https://github.com/bank-vaults/bank-vaults)
23+
- [Vals Operator](https://github.com/digitalis-io/vals-operator)
24+
- [Vault CSI Provider](https://developer.hashicorp.com/vault/docs/platform/k8s/csi)
25+
26+
## 3. <a name='Ourneeds'></a>Our needs
27+
28+
Here are our needs by importance in our research :
29+
30+
- Handle database engine
31+
- Injection through environment variables
32+
- Easy to use for developpers
33+
- Audit logging
34+
- Lease can be automatically renewed and revoked
35+
- State is available for debugging purpose and manual revocation also
36+
- Working with a single deployment
37+
38+
39+
## 4. <a name='ComparisonTable'></a>Comparison Table
40+
41+
| Feature | Vault-Db-Injector | Vault Agent Injector | Bank Vault (webhook) | Vals Operator | Vault CSI Provider |
42+
|--------------------------------------|-----------------------|-------------------------------------|------------------------------------|---------------------------------|---------------------------------|
43+
| **Credential Source** | Vault Database Engine | Multiple Engines | Secret Engine | Multiple Engine | K/V |
44+
| **Engine** | Database | All | K/V | Database and K/V | K/V |
45+
| **Injection Method** | Pod Environment Vars | Sidecar Container / Init Container | Init Container (in-memory) | Kubernetes Secrets | CSI Volume |
46+
| **Dynamic Secret Rotation** | 🚫 Not needed | ✅ Yes | ✅ Yes | ❌ No | ✅ Yes |
47+
| **Access Control** | Role-Based Policies | Role-Based Policies | Role-Based Policies | Role-Based Policies | Role-Based Policies |
48+
| **Configuration Complexity** | 🟢 Low | 🔴 Very High | 🟢 Low | 🟠 Moderate | 🟠 Moderate |
49+
| **User Complexity** | 🟢 Low | 🔴 Very High | 🟢 Low | 🟠 Moderate | 🟢 Low |
50+
| **Operation Mode** | Deployment | Deployment | Deployment | Operator | Operator |
51+
| **Configuration Mode** | Annotations | Annotations | Through Env | CRDS | CRDS |
52+
| **Handle Environment** | ✅ Yes | ❌ No | ✅ Yes | ✅ Yes | ✅ Yes (secretRef) |
53+
| **Secret Encryption** | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes |
54+
| **Audit Logging** | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes |
55+
| **Accessible state** | ✅ Yes | ❌ No | ❌ No | ❌ No | ❌ No |
56+
| **Lease Renew** | ✅ Yes | ✅ Yes | - | 🤔 With restarting | - |
57+
| **Lease Revocation** | ✅ Yes | ❌ No | - | ❌ No | - |
58+
| **Community Support** | 🌱 Growing | 🟢 Established | 🟠 Moderate | 🟠 Moderate | 🟢 Established |
59+
60+
### 4.1. <a name='Key'></a>Key
61+
62+
- ✅ Yes
63+
- ❌ No
64+
- 🤔 Consideration (Intermediate)
65+
- 🚫 Not Needed
66+
- 🟢 Low
67+
- 🟠 Moderate
68+
- 🔴 High
69+
70+
## 5. <a name='Conclusion'></a>Conclusion
71+
72+
This comparison highlights the unique features and capabilities of the new vault injector. While similar in many ways to existing solutions, the new tool offers dynamic secret rotation without requiring pod restarts, moderate configuration complexity, and robust access control, making it a compelling choice for managing secrets in Kubernetes environments.

‎docs/getting-started/getting-started.md

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,4 @@
11
# getting-started
2-
<!-- vscode-markdown-toc -->
3-
* 1. [Requirements](#Requirements)
4-
* 2. [Vocabulary](#Vocabulary)
5-
* 3. [Vault Configuration](#VaultConfiguration)
6-
* 3.1. [Create `all-rw` vault-policy](#Createall-rwvault-policy)
7-
* 3.2. [Create `K/V Vault`](#CreateKVVault)
8-
* 3.3. [Create `vault databases mount`](#Createvaultdatabasesmount)
9-
* 3.4. [Create `vault databases backend connection`](#Createvaultdatabasesbackendconnection)
10-
* 3.5. [Create a `kubernetes auth backend`](#Createakubernetesauthbackend)
11-
* 3.6. [Create a `kubernetes auth backend role`](#Createakubernetesauthbackendrole)
12-
* 3.7. [Create `vault databases backend role`](#Createvaultdatabasesbackendrole)
13-
* 4. [`Database` configuration](#Databaseconfiguration)
14-
* 5. [Deploy the vault db injector](#Deploythevaultdbinjector)
15-
* 6. [Deploy an example application :](#Deployanexampleapplication:)
16-
17-
<!-- vscode-markdown-toc-config
18-
numbering=true
19-
autoSave=true
20-
/vscode-markdown-toc-config -->
21-
<!-- /vscode-markdown-toc -->
222

233
## 1. <a name='Requirements'></a>Requirements
244

‎docs/how-it-works/configuration.md

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,8 @@
11
# Configuration
2-
<!-- vscode-markdown-toc -->
3-
* 1. [Configuration](#Configuration)
4-
* 1.1. [Mode Injector](#ModeInjector)
5-
* 1.2. [Mode token-renewer](#Modetoken-renewer)
6-
* 1.3. [Mode token-renewer](#Modetoken-renewer-1)
7-
8-
<!-- vscode-markdown-toc-config
9-
numbering=true
10-
autoSave=true
11-
/vscode-markdown-toc-config -->
12-
<!-- /vscode-markdown-toc -->
132

143
Here is the configuration for Vault Injector:
154

16-
#### 1.1. <a name='ModeInjector'></a>Mode Injector
5+
# 1 <a name='ModeInjector'></a>Mode Injector
176
The Injector mode is basic one that will handle all api-server request and handle all requests to vault to generate credentials to our DB
187
The config file path can be parse by adding the path with : `- "--config=/injector/config.yaml"`
198
```yaml
@@ -33,7 +22,7 @@ injectorLabel: vault-db-injector
3322
defaultEngine: databases
3423
```
3524
36-
#### 1.2. <a name='Modetoken-renewer'></a>Mode token-renewer
25+
# 1 <a name='Modetoken-renewer'></a>Mode token-renewer
3726
The Renewer one is a process that will run every hour and validate that all orphan token won't expire before pod is deleted
3827
The config file path can be parse by adding the path with : `- "--config=/renewer/config.yaml"`
3928
```yaml
@@ -52,7 +41,7 @@ injectorLabel: vault-db-injector
5241
defaultEngine: databases
5342
```
5443

55-
#### 1.3. <a name='Modetoken-renewer-1'></a>Mode token-renewer
44+
# 1 <a name='Modetoken-renewer-1'></a>Mode token-renewer
5645
The Revoker one is a process that is going to watch pod deletion Kubernetes events filtered with the label `vault-db-injector: true` and will revoke token attached to the pod when it is deleted
5746
The config file path can be parse by adding the path with : `- "--config=/revoker/config.yaml"`
5847
```yaml

‎docs/how-it-works/healthcheck.md

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,4 @@
11
# Health Checks
2-
<!-- vscode-markdown-toc -->
3-
* 1. [How It Works:](#HowItWorks:)
4-
* 2. [Key Responsibilities:](#KeyResponsibilities:)
5-
* 3. [Benefits:](#Benefits:)
6-
7-
<!-- vscode-markdown-toc-config
8-
numbering=true
9-
autoSave=true
10-
/vscode-markdown-toc-config -->
11-
<!-- /vscode-markdown-toc -->
122

133
**Key File:** `pkg/healthcheck/healthcheck.go`
144

‎docs/how-it-works/how-it-work.md

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,6 @@
11
# How it Work
22

3-
<!-- vscode-markdown-toc -->
4-
* 1. [Vault-Injector](#Vault-Injector)
5-
* 1.1. [Mechanism](#Mechanism)
6-
* 1.1.1. [Vault Injector:](#VaultInjector:)
7-
* 1.2. [Diagram](#Diagram)
8-
* 1.3. [Vault Usage](#VaultUsage)
9-
* 1.4. [Authentication](#Authentication)
10-
* 1.5. [How token are handled ?](#Howtokenarehandled)
11-
* 1.6. [How does injector work then ?](#Howdoesinjectorworkthen)
12-
* 1.7. [Usage :](#Usage:)
13-
* 1.7.1. [In mode classic](#Inmodeclassic)
14-
* 1.7.2. [In mode URI](#InmodeURI)
15-
* 1.7.3. [With multiple databases](#Withmultipledatabases)
16-
17-
<!-- vscode-markdown-toc-config
18-
numbering=true
19-
autoSave=true
20-
/vscode-markdown-toc-config -->
21-
<!-- /vscode-markdown-toc -->## 1. <a name='Vault-Injector'></a>Vault-Injector
3+
## 1. <a name='Vault-Injector'></a>Vault-Injector
224

235
The Vault DB Injector is a Go program that is design to retrieve databases credentials from Hashicorp Vault, it use Kubernetes Mutating Webhook to intercept pod creation activated with a label and configured with annotations.
246
After the credentials are provided, it will store them in a specific Vault KV and will handle the lifecycle of them such as :

‎docs/how-it-works/injector.md

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,5 @@
11
# Injector
22

3-
<!-- vscode-markdown-toc -->
4-
* 1. [How It Works:](#HowItWorks:)
5-
* 2. [Benefits:](#Benefits:)
6-
7-
<!-- vscode-markdown-toc-config
8-
numbering=true
9-
autoSave=true
10-
/vscode-markdown-toc-config -->
11-
<!-- /vscode-markdown-toc -->
12-
133
**Key File:** `pkg/injector/injector.go`
144

155
## 1. <a name='HowItWorks:'></a>How It Works:

‎docs/how-it-works/kubernetes.md

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,5 @@
11
# Kubernetes Integration
22

3-
<!-- vscode-markdown-toc -->
4-
* 1. [How It Works:](#HowItWorks:)
5-
* 2. [Key Responsibilities:](#KeyResponsibilities:)
6-
* 3. [Benefits:](#Benefits:)
7-
* 3.1. [Annotations :](#Annotations:)
8-
9-
<!-- vscode-markdown-toc-config
10-
numbering=true
11-
autoSave=true
12-
/vscode-markdown-toc-config -->
13-
<!-- /vscode-markdown-toc -->
14-
153
**Key Files:** `pkg/k8s/connect.go`, `pkg/k8s/pod_utils.go`, `pkg/k8s/parse_annotations.go`
164

175
## 1. <a name='HowItWorks:'></a>How It Works:

‎docs/how-it-works/leaderelection.md

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,5 @@
11
# Leader Election
22

3-
<!-- vscode-markdown-toc -->
4-
* 1. [How It Works:](#HowItWorks:)
5-
* 2. [Key Responsibilities:](#KeyResponsibilities:)
6-
* 3. [Benefits:](#Benefits:)
7-
8-
<!-- vscode-markdown-toc-config
9-
numbering=true
10-
autoSave=true
11-
/vscode-markdown-toc-config -->
12-
<!-- /vscode-markdown-toc -->
13-
143
**Key File:** `pkg/leadership/leadership.go`
154

165
## 1. <a name='HowItWorks:'></a>How It Works:

‎docs/how-it-works/renewer.md

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,5 @@
11
# Renewer
22

3-
<!-- vscode-markdown-toc -->
4-
* 1. [How It Works:](#HowItWorks:)
5-
* 2. [Key Responsibilities:](#KeyResponsibilities:)
6-
* 3. [Benefits:](#Benefits:)
7-
8-
<!-- vscode-markdown-toc-config
9-
numbering=true
10-
autoSave=true
11-
/vscode-markdown-toc-config -->
12-
<!-- /vscode-markdown-toc -->
13-
143
**Key File:** `pkg/renewer/renewer.go`
154

165
## 1. <a name='HowItWorks:'></a>How It Works:

0 commit comments

Comments
 (0)