PAM

Kubernetes Secrets Operator

A lightweight Kubernetes operator (~5.5MB binary) syncs CoreLink secrets into native Kubernetes Secret objects so existing workloads consume them with no code changes. Declare a SecretSync custom resource that references a CoreLink secret name and target namespace, and the operator maintains the Kubernetes Secret up-to-date on every rotation.

The operator authenticates to CoreLink via NHI passwordless attestation using the pod's service account token. No long-lived tokens, no sidecar injection, no mutating webhooks.

Kubernetes Secrets Operator screenshot

Key Configuration

  • SecretSync refresh interval
  • Target namespaces allowlist
  • NHI ID for operator authentication
  • Sync failure alert channel
All documentation Question about this? Talk to us