K8s Secrets Provider Deployment Manifest

k8sSecretsProvider.yml

---
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
  namespace: k8s-secrets-app
type: Opaque
stringData:
  conjur-map: |-   
    address: cd/kubernetes/db/host
    db_name: cd/kubernetes/db/name
    username: cd/kubernetes/db/username
    password: cd/kubernetes/db/password

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8ssecrets-account
  namespace: k8s-secrets-app

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secrets-access
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: [ "get", "update"]

# UNCOMMENT BELOW FOR NAMESPACE-SCOPED ROLE
#---
#apiVersion: rbac.authorization.k8s.io/v1
#kind: Role
#metadata:
#  namespace: k8s-secrets-app
#  name: secrets-access
#rules:
#- apiGroups: [""]
#  resources: ["secrets"]
#  verbs: ["get", "update"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: k8s-secrets-app
  name: secrets-access-binding
subjects:
  - kind: ServiceAccount
    namespace: k8s-secrets-app
    name: k8ssecrets-account
roleRef:
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
  name: secrets-access

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: k8ssecrets-demo
  namespace: k8s-secrets-app
  labels:
    app: k8ssecrets
spec:
  replicas: 1
  selector:
    matchLabels:
      role: demo
      app: k8ssecrets
  template:
    metadata:
      labels:
        role: demo
        app: k8ssecrets
    spec:
      serviceAccountName: k8ssecrets-account
      initContainers:
      - name: cyberark-secrets-provider
        image: cyberark/secrets-provider-for-k8s:latest
        imagePullPolicy: IfNotPresent
        env:
          - name: MY_POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: MY_POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: MY_POD_IP
            valueFrom:
              fieldRef:
                fieldPath: status.podIP
          - name: CONJUR_APPLIANCE_URL
            value: https://conjur.joegarcia.dev/api
          - name: CONTAINER_MODE
            value: init
          - name: CONJUR_AUTHN_URL
            value: https://conjur.joegarcia.dev/api/authn-k8s/conjur-demo
          - name: CONJUR_ACCOUNT
            value: cyberarkdemo
          - name: CONJUR_VERSION
            value: '5'
          - name: CONJUR_SSL_CERTIFICATE
            valueFrom:
              configMapKeyRef:
                name: conjur-ssl-cert
                key: conjur_joegarcia_dev.pem
          - name: CONJUR_AUTHN_LOGIN
            value: host/cd/kubernetes/k8s-secrets-app
          - name: SECRETS_DESTINATION
            value: k8s_secrets
          - name: K8S_SECRETS
            value: db-credentials
      containers:
      - name: k8s-app
        image: centos
        command: ["sleep","infinity"]
        imagePullPolicy: IfNotPresent
        env:
          - name: DB_ADDRESS
            valueFrom:
              secretKeyRef:
                name: db-credentials
                key: address
          - name: DB_NAME
            valueFrom:
              secretKeyRef:
                name: db-credentials
                key: db_name
          - name: DB_USERNAME
            valueFrom:
              secretKeyRef:
                name: db-credentials
                key: username
          - name: DB_PASSWORD
            valueFrom:
              secretKeyRef:
                name: db-credentials
                key: password

Prior to applying, run: kubectl create namespace k8s-secrets-app && kubectl -n k8s-secrets-app create configmap conjur-ssl-cert --from-file=/Users/joegarcia/OneDrive/CyberArk/Software/Certificates/conjur_joegarcia_dev.pem