credentials-operator
spire
credentials-operator | spire | |
---|---|---|
6 | 4 | |
59 | 1,818 | |
- | 1.5% | |
8.3 | 9.8 | |
6 days ago | 6 days ago | |
Go | Go | |
Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
credentials-operator
-
Otterize launches open-source, declarative IAM permissions for workloads on AWS EKS clusters
No more! The open-source intents-operator and credentials-operator enable you to achieve the same, except without all that work: do it all from Kubernetes, declaratively, and just-in-time, through the magic of IBAC (intent-based access control).
-
How to have SSL certificates for all my home lab Kubernetes apps?
Otterize Credential Operator ( https://github.com/otterize/credentials-operator ) helps you automatically provision credentials as Kubernetes secrets (using a self-hosted SPIRE or a free SaaS solution). You can use pod annotations to determine the certificate's domain names (as well as many other properties). I think it is a straightforward approach to managing trust, especially for a relatively small cluster where you manage everything. (Full disclosure: I am one of the contributors to this project)
-
Ask r/kubernetes: What are you working on this week?
Have you taken a look at using SPIRE to create the TLS certificates and attesting about the workload identity? You could couple SPIRE server with the Otterize SPIRE integration operator to declaratively generate TLS certificates. This could be easier to deploy than a service mesh and sidecars, depending on your use case - what the clients are and what the servers are.
-
How to authenticate microservices?
You could create JWT or mTLS-based identities, and then verify those in your middleware. If you are on Kubernetes, you might try using SPIRE together with the SPIRE integration operator to automatically issue identities as Kubernetes secrets, which you could then use to connect between services.
-
Who defines secret management / certificate management in your company
In practice, the technical part is implemented by the DevOps/platform team. The way in which you declare and get access to these secrets varies, but can be one of the cloud provider secret managers (e.g. AWS Secret Manager), Hashicorp Vault, or if you're on Kubernetes, could be something like cert-manager, Hashicorp Vault sidecars, or SPIRE coupled with the Otterize SPIRE integration.
-
How to automate certificate renewal with Azure Key vault?
If this seems a bit complicated, you could use SPIRE server to issue certificates and Otterize SPIRE integration operator to renew them in Kubernetes and update Secrets.
spire
-
How to automate certificate renewal with Azure Key vault?
If this seems a bit complicated, you could use SPIRE server to issue certificates and Otterize SPIRE integration operator to renew them in Kubernetes and update Secrets.
- Spire - The spiffe runtime environment
-
What are the most important metrics for measuring cloud and endpoint security?
BlindSPOT: https://blindspotsec.com/ Specific graphic from BlindSPOT: https://blindspotsec.com/wp-content/uploads/2021/04/Failure_Before.jpg How to Measure Anything in Cybersecurity Risk: https://www.amazon.com/dp/B01J4XYM16/ Monte Carlo simulation approach: https://embracethered.com/blog/posts/2020/red-teaming-and-monte-carlo-simulations/ D3FEND: https://d3fend.mitre.org/ ATT&CK mappings: https://github.com/center-for-threat-informed-defense/attack-control-framework-mappings ATT&CK evals: https://attackevals.mitre-engenuity.org/index.html CALDERA: https://github.com/mitre/caldera Offensive Countermeasures: https://www.amazon.com/dp/1974671690/ SPIFFE: https://spiffe.io/ SPIRE: https://github.com/spiffe/spire Zerotier: https://www.zerotier.com/ Zerotier libzt: https://github.com/zerotier/libzt
-
Zero-trust networking for bare-metal systems, using Rust.
The effort to get this going seems the same or more than to get something like this rolling out. spire what do you see as the benefit of your approach.
What are some alternatives?
bouncer - JWT-based authentication and authorization service
spiffe-vault - Integrates Spiffe and Vault to have secretless authentication
network-mapper - Map Kubernetes traffic: in-cluster, to the Internet, and to AWS IAM and export as text, intents, or an image
cosign - Code signing and transparency for containers and binaries
intents-operator - Manage network policies, AWS, GCP & Azure IAM policies, Istio Authorization Policies, and Kafka ACLs in a Kubernetes cluster with ease.
in-toto-golang - A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.
kube-reqsizer - A Kubernetes controller for automatically optimizing pod requests based on their continuous usage. VPA alternative that can work with HPA.
libzt - Encrypted P2P sockets over ZeroTier
OPA (Open Policy Agent) - Open Policy Agent (OPA) is an open source, general-purpose policy engine.
Vault - A tool for secrets management, encryption as a service, and privileged access management
attack-control-framework-mappings - 🚨ATTENTION🚨 The NIST 800-53 mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.
ZeroTier - A Smart Ethernet Switch for Earth