PAM
Kubernetes Secrets Operator
A lightweight Kubernetes operator (~5.5MB binary) syncs CoreLink secrets into native Kubernetes Secret objects so existing workloads consume them with no code changes. Declare a SecretSync custom resource that references a CoreLink secret name and target namespace, and the operator maintains the Kubernetes Secret up-to-date on every rotation.
The operator authenticates to CoreLink via NHI passwordless attestation using the pod's service account token. No long-lived tokens, no sidecar injection, no mutating webhooks.
Key Configuration
- SecretSync refresh interval
- Target namespaces allowlist
- NHI ID for operator authentication
- Sync failure alert channel