kube-auth-store

Inspiration

Lots of tech companies, including non-profit companies are turning to Kubernetes to run their workloads. Where to store these creds easily and securely?

What it does

Each K8s cluster has a config object which contains access information (password, certs, username) that kubectl and other applications need in order to access the cluster. I created an API and storage system that can hold cluster creds securely and provide to authenticated users/services when needed.

How I built it

Serverless Framework provided the deployment system for me quickly iterate over changes to the GET and POST requests

Challenges I ran into

Taking in the K8s config object and abstracting the secrets and putting into AWS Secrets Manager wasn't as straightforward as I expected. AWS Secrets Manager doesn't support 'paginator' in the boto3 API so I had to whip up a custom paginator.

Accomplishments that I'm proud of

Developed a solid secure API without needing to provision a single EC2 instance :)

What I learned

The ins and outs of the AWS Secrets Manager service and boto3 API interface

What's next for kube-auth-store

I would like to add in-place update support for new creds on a k8s cluster or additional users.

Built With

• aws-apigateway
• aws-secrets-manager
• dynamodb
• python
• serverless