Examples

Complete, runnable examples for the Kubernetes Injector integration in Keeper Secrets Manager

These are complete, runnable examples for the Kubernetes Injector. Each one assumes you have already installed the injector and created the KSM authentication secret (keeper-credentials) as described on that page.

Record and field names below (for example database-credentials, tls-cert, Production/Databases) are illustrative - create matching records in your Shared folder that is shared to Keeper Secrets Manager Application, or change the annotations to point at your own records.

Quick check: inject a secret into a Pod

The fastest way to confirm the injector is working - fetch a record to a file and read it. The below .yaml configuration file demonstrates the feature.

apiVersion: v1
kind: Pod
metadata:
  name: hello-secrets
  annotations:
    keeper.security/inject: "true"
    keeper.security/ksm-config: "keeper-credentials"
    keeper.security/secret: "demo-secret"
spec:
  containers:
    - name: app
      image: busybox:1.36
      command: ["sh", "-c", "cat /keeper/secrets/demo-secret.json && sleep 3600"]

kubectl logs hello-secrets         # prints the record JSON
kubectl get pod hello-secrets -o jsonpath='{.spec.containers[*].name}'   # includes keeper-secrets-sidecar

Database credentials as a file

The default mode: the record is written as JSON to /keeper/secrets/, and the app reads it.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 1
  selector: { matchLabels: { app: web } }
  template:
    metadata:
      labels: { app: web }
      annotations:
        keeper.security/inject: "true"
        keeper.security/ksm-config: "keeper-credentials"
        keeper.security/secret: "database-credentials"
    spec:
      containers:
        - name: web
          image: my-app:latest   # reads /keeper/secrets/database-credentials.json

Render a .env file

Use the config block to choose an output format. Here the record is rendered as a .env file the app can source.

metadata:
  annotations:
    keeper.security/inject: "true"
    keeper.security/ksm-config: "keeper-credentials"
    keeper.security/config: |
      secrets:
        - record: database-credentials
          path: /keeper/secrets/db.env
          format: env

kubectl exec deploy/web -c app -- cat /keeper/secrets/db.env
# LOGIN=app_user
# PASSWORD=...

Build a connection string with a template

Go templates (with Sprig functions) turn record fields into any format - here a Postgres URL.

metadata:
  annotations:
    keeper.security/inject: "true"
    keeper.security/ksm-config: "keeper-credentials"
    keeper.security/config: |
      secrets:
        - record: database-credentials
          path: /keeper/secrets/db-url.txt
          template: |
            postgresql://{{ .login }}:{{ .password }}@{{ .host }}:5432/app

Inject as environment variables

For legacy apps that only read env vars. Field names become uppercased keys; add a prefix and fetch once at startup (env vars can't change without a restart).

apiVersion: v1
kind: Pod
metadata:
  name: legacy-app
  annotations:
    keeper.security/inject: "true"
    keeper.security/ksm-config: "keeper-credentials"
    keeper.security/inject-env-vars: "true"
    keeper.security/env-prefix: "APP_"
    keeper.security/secret: "database-credentials"
    keeper.security/init-only: "true"
spec:
  containers:
    - name: app
      image: legacy-app:latest   # sees APP_LOGIN, APP_PASSWORD, ...

Environment variables are stored in the Pod spec (visible in kubectl get pod -o yaml, persisted in etcd). Prefer file injection for sensitive values.

Create a Kubernetes Secret for a Deployment

When a workload needs a native Secret (for secretKeyRef, envFrom, or a Secret volume), have the injector create one from the record.

apiVersion: v1
kind: Pod
metadata:
  name: app-with-secret
  annotations:
    keeper.security/inject: "true"
    keeper.security/ksm-config: "keeper-credentials"
    keeper.security/inject-as-k8s-secret: "true"
    keeper.security/k8s-secret-name: "app-secrets"
    keeper.security/secret: "database-credentials"
spec:
  containers:
    - name: app
      image: my-app:latest
      env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: app-secrets
              key: password

kubectl get secret app-secrets -o jsonpath='{.data}' | jq 'keys'   # ["login","password",...]

TLS certificate and key for NGINX

Download file attachments from a Keeper record to a path your app mounts.

apiVersion: v1
kind: Pod
metadata:
  name: tls-nginx
  annotations:
    keeper.security/inject: "true"
    keeper.security/ksm-config: "keeper-credentials"
    keeper.security/file-cert: "tls-cert:server.crt:/keeper/secrets/tls/tls.crt"
    keeper.security/file-key: "tls-cert:server.key:/keeper/secrets/tls/tls.key"
spec:
  containers:
    - name: nginx
      image: nginx:alpine
      volumeMounts:
        - name: keeper-secrets
          mountPath: /etc/nginx/tls
          subPath: tls

Inject every secret in a folder

Fetch all records in a Keeper folder - one file per record under the output path.

metadata:
  annotations:
    keeper.security/inject: "true"
    keeper.security/ksm-config: "keeper-credentials"
    keeper.security/folder: "Production/Databases"
    keeper.security/folder-path: "/keeper/secrets/db"

You can also reference a folder by UID with keeper.security/folder-uid.

Extract a single field with Keeper Notation

Write just one field to a precise path using Keeper Notation. Notation is parsed by the per-secret keeper.security/secret-<name> annotation (the plain keeper.security/secret annotation always treats its value as a record title).

metadata:
  annotations:
    keeper.security/inject: "true"
    keeper.security/ksm-config: "keeper-credentials"
    keeper.security/secret-token: "keeper://API-Keys-UID/field/password:/keeper/secrets/token.txt"

Automatic rotation

In sidecar mode the agent re-fetches on an interval and rewrites the files in place - no Pod restart. Apps that re-read the file pick up the new value automatically.

metadata:
  annotations:
    keeper.security/inject: "true"
    keeper.security/ksm-config: "keeper-credentials"
    keeper.security/secret: "database-credentials"
    keeper.security/refresh-interval: "1m"

# rotate the value in Keeper, then watch it update in place:
kubectl exec deploy/web -c app -- sh -c 'while :; do cat /keeper/secrets/database-credentials.json; sleep 10; done'

More examples and Github Source

The injector's GitHub repository has a full catalog of runnable examples (web demos, databases, rotation dashboards, resilience, cloud auth, and more).

• View the Github Source