A lightweight operator syncs CoreLink secrets into native K8s Secrets -- version-tracked, auto-refreshed, no controller-runtime dependency.
See It In Action
Deploy once. Secrets stay current automatically.
From operator deployment to continuously refreshed K8s Secrets, fully automated and version-aware.
Apply the CoreLink operator manifest to your cluster. At 5.5MB with no CRDs and no controller-runtime dependency, it starts in seconds.
A ConfigMap defines which CoreLink secrets map to which K8s Secret names and namespaces. No CRDs, no custom resources -- standard Kubernetes primitives.
The operator continuously polls CoreLink for version changes. When a secret rotates, the operator updates the K8s Secret automatically. Version tracking skips unnecessary writes.
One operator. Every namespace. Continuously synchronized.
AES-256-GCM
5.5MB Binary
No CRDs. No controller-runtime. ConfigMap-driven.
Native Objects
Managed-by label tracks operator ownership
Zero Changes
Pods consume secrets normally via env or volume
No custom controllers. No CRDs. Just a ConfigMap and a lightweight binary.
The sync map is defined in a plain Kubernetes ConfigMap. No CRDs, no custom resources, no operator framework required. Roll back the sync config by reverting the ConfigMap.
The operator tracks the CoreLink version number of each synced secret and skips writes when the version has not changed. This avoids unnecessary K8s API calls and pod restarts.
Every K8s Secret created by the operator is tagged with app.kubernetes.io/managed-by=corelink-operator. Easily identify and audit operator-managed secrets across namespaces.
The operator is a single static Go binary at 5.5MB. No controller-runtime, no kubebuilder scaffolding. Runs as a minimal Deployment with a read-only service account.
The operator syncs secrets into K8s Secret objects, but the source of truth stays in CoreLink. When a secret rotates in CoreLink, the operator propagates the new value automatically -- no manual kubectl apply required.
CoreLink stores every secret value with envelope encryption (AES-256-GCM). The operator retrieves the decrypted value over TLS and writes it to the K8s Secret. etcd stores the K8s Secret, but with at-rest encryption enabled on the cluster, the value is never stored in plaintext.
Deploy the CoreLink operator and let secrets flow automatically from the vault to your pods -- version-tracked and auto-refreshed.