Skip to content

Commit 9de4cb5

Browse files
SoulKyuSoulKyu
committed
Add tools comparison
1 parent f350878 commit 9de4cb5

File tree

3 files changed

+76
-0
lines changed

3 files changed

+76
-0
lines changed

‎README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ Checkout the [Vault DB Injector documentation](https://numberly.github.io/vault-
1616

1717
Contributions to the vault-db-injector are welcome. Please submit your pull requests or issues to the project's GitLab repository.
1818

19+
## 4. <a name='Tool Comparison'></a>Projects Comparison
20+
21+
Here you can find a comparison with many vault injector projects : [Comparaison](https://numberly.github.io/vault-db-injector/getting-started/comparison/)
1922

2023
## 5. <a name='Acknowledgements'></a>Acknowledgements
2124

‎docs/getting-started/comparison.md

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# Comparison
2+
3+
A vault injector retrieves credentials from a vault database engine and injects them into pods' environment variables. This document compares different existing tools with the new vault injector being developed.
4+
5+
## Summary
6+
7+
## 1. <a name='WhyVault-Db-Injector'></a>Why Vault-Db-Injector?
8+
9+
Before comparing Vault-Db-Injector with existing tools, we would like to share that we initially investigated various vault injector solutions designed to fetch credentials from Vault.
10+
11+
After extensive research, we found no tools that matched our needs, and most of them were difficult to contribute to.
12+
13+
Vault-Db-Injector is not a replacement for any existing vault injector but a tool more focused on security and the database engine.
14+
15+
We didn't intend to reinvent the wheel but designed a tool that perfectly matches our needs and shared it with those who might be interested.
16+
17+
## 2. <a name='ToolsComparison'></a>Tools Comparison
18+
19+
Here are the major tools that we compare our injector to:
20+
21+
- [Vault Agent Injector](https://developer.hashicorp.com/vault/docs/platform/k8s/injector)
22+
- [Bank Vault](https://github.com/bank-vaults/bank-vaults)
23+
- [Vals Operator](https://github.com/digitalis-io/vals-operator)
24+
- [Vault CSI Provider](https://developer.hashicorp.com/vault/docs/platform/k8s/csi)
25+
26+
## 3. <a name='Ourneeds'></a>Our needs
27+
28+
Here are our needs by importance in our research :
29+
30+
- Handle database engine
31+
- Injection through environment variables
32+
- Easy to use for developpers
33+
- Audit logging
34+
- Lease can be automatically renewed and revoked
35+
- State is available for debugging purpose and manual revocation also
36+
- Working with a single deployment
37+
38+
39+
## 4. <a name='ComparisonTable'></a>Comparison Table
40+
41+
| Feature | Vault-Db-Injector | Vault Agent Injector | Bank Vault (webhook) | Vals Operator | Vault CSI Provider |
42+
|--------------------------------------|-----------------------|-------------------------------------|------------------------------------|---------------------------------|---------------------------------|
43+
| **Credential Source** | Vault Database Engine | Multiple Engines | Secret Engine | Multiple Engine | K/V |
44+
| **Engine** | Database | All | K/V | Database and K/V | K/V |
45+
| **Injection Method** | Pod Environment Vars | Sidecar Container / Init Container | Init Container (in-memory) | Kubernetes Secrets | CSI Volume |
46+
| **Dynamic Secret Rotation** | 🚫 Not needed | ✅ Yes | ✅ Yes | ❌ No | ✅ Yes |
47+
| **Access Control** | Role-Based Policies | Role-Based Policies | Role-Based Policies | Role-Based Policies | Role-Based Policies |
48+
| **Configuration Complexity** | 🟢 Low | 🔴 Very High | 🟢 Low | 🟠 Moderate | 🟠 Moderate |
49+
| **User Complexity** | 🟢 Low | 🔴 Very High | 🟢 Low | 🟠 Moderate | 🟢 Low |
50+
| **Operation Mode** | Deployment | Deployment | Deployment | Operator | Operator |
51+
| **Configuration Mode** | Annotations | Annotations | Through Env | CRDS | CRDS |
52+
| **Handle Environment** | ✅ Yes | ❌ No | ✅ Yes | ✅ Yes | ✅ Yes (secretRef) |
53+
| **Secret Encryption** | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes |
54+
| **Audit Logging** | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes |
55+
| **Accessible state** | ✅ Yes | ❌ No | ❌ No | ❌ No | ❌ No |
56+
| **Lease Renew** | ✅ Yes | ✅ Yes | - | 🤔 With restarting | - |
57+
| **Lease Revocation** | ✅ Yes | ❌ No | - | ❌ No | - |
58+
| **Community Support** | 🌱 Growing | 🟢 Established | 🟠 Moderate | 🟠 Moderate | 🟢 Established |
59+
60+
### 4.1. <a name='Key'></a>Key
61+
62+
- ✅ Yes
63+
- ❌ No
64+
- 🤔 Consideration (Intermediate)
65+
- 🚫 Not Needed
66+
- 🟢 Low
67+
- 🟠 Moderate
68+
- 🔴 High
69+
70+
## 5. <a name='Conclusion'></a>Conclusion
71+
72+
This comparison highlights the unique features and capabilities of the new vault injector. While similar in many ways to existing solutions, the new tool offers dynamic secret rotation without requiring pod restarts, moderate configuration complexity, and robust access control, making it a compelling choice for managing secrets in Kubernetes environments.

‎mkdocs.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ nav:
4545
- Home: index.md
4646
- Getting Started:
4747
- getting-started/getting-started.md
48+
- getting-started/comparison.md
4849
- getting-started/build.md
4950
- How it Works:
5051
- how-it-works/how-it-work.md

0 commit comments

Comments
 (0)