PassLess Operator implements a concept of secret management without the need of credentials storage for usage in Kubernetes. It utilize master password algorithm to achieve that.
Using PassLess you can avoid storing passwords in your GitOps workflow or the need of secure data source like LDAP, or HashiCorp's Vault.
Deploy operator with:
kubectl apply -f \
https://github.com/wavesoftware/passless-operator/releases/download/v0.3.0/passless.yaml
This is an example passless resource:
---
apiVersion: wavesoftware.pl/v1alpha1
kind: PassLess
metadata:
name: example
spec:
db-password:
version: 1
scope: alnum
length: 16
It define a Kubernetes secret's template. If you have Passless operator running, and you create such a resource, operator will create a secret for you. It will also, update it if you change passless resource!
$ kubectl get passless
NAME AGE
example 12s
$ kubectl get secrets
NAME TYPE DATA AGE
example Opaque 1 10s
$ kubectl get secret example -o jsonpath='{.data.db-password}' | base64 -d
eoXdlNHgrtaxoO34
Each PassLess specification element defines a secret element to be created, and each password generation can be influenced by providing an options:
version
- A sequential password number. Changing the password should be done by advancing this number. Default value is1
.scope
- A definition of scope that the password will be generated from. It may be one of (defaults toalnum
):num
for numeric passwords,alpha
for alphabet based passwords, both big and small caps,alnum
for alphanumeric passwords, both big and small caps,human
for letters and numbers that are easy to distinguish by human,keys
for passwords that can be typed by keyboard, so letters, and numbers, and special characters,utf8
these passwords contain utf-8 characters, so also a characters that aren't easy to type by keyboard,list:
followed by list of chars that might be used. Ex.:list:abcdef1234567890!$
,
length
- A length of password to be generated in number of signs. Default value is16
.
PassLess created secrets use Master Password algorithm. The master key is derived
from default-token
secret form kube-system
namespace. Site key uses the name
of passless resource and namespace in which it is created.
Above means that the password for the same parameters given will the same, but
different if created in other namespace or with other name. All passwords will
change if default-token
secret form kube-system
namespace is changed.
For now, this behavior isn't configurable, but it's good idea for future features.
If you'd like to build the operator yourself, you will need to have
Golang installed on your machine. Check the go.mod
file for current minimum version.
To build the operator, invoke the following command:
$ make build
Project will check, test and build binaries. You'll get an executable
operator controller build/bin
dir.
You could also deploy the operator on Kubernetes cluster with following
command. Remember to set environment variable IMAGE_TAG_BASE
to be used as
a base of image used.
$ export IMAGE_TAG_BASE=gcr.io/vivid-osmos-110/passless-operator
$ make deploy
To remove operator from cluster run:
$ make undeploy