El gestor de contraseñas en el que confían millones de personas | Bitwarden Centro de ayuda (2024)

Administrador de secretosIntegraciones

The Bitwarden Secrets Manager Kubernetes Operator will allow teams to integrate Secrets Manager into Kubernetes workflows securely and efficiently. Using the operator, which is deployed using Helm package manager, secrets can be stored and retrieved from Secrets Manager.

Bitwarden Secrets Manager Kubernetes Operator

The sm-operator uses a controller to synchronize Bitwarden secrets into Kubernetes secrets. The operator registers the Custom Resource Definition: BitwardenSecret into the Kubernetes cluster. The cluster will listen for the newly registered BitwardenSecret, and synchronize on a configurable interval.

To get started, an active Bitwarden organization with Secrets Manager is required. Additionally, one or more access tokens associated with a machine account are required.

Additional dependencies

• kubectl

• Helm 3

Add the Bitwarden Secrets Manager chart repository:

Bash
helm repo add bitwarden https://charts.bitwarden.com/

Update information of locally available charts:

Bash
helm repo update
See Also
Field Extractor: Select Sample stepExtract fields from event data using Ingest ProcessorSplunk Regex Field Extraction: A Comprehensive GuidePlan for field filters in your organization

Create a configuration file

Create a custom values file used for deployment:

Bash
helm show values bitwarden/sm-operator > my-values.yaml

Update configuration file

Locate my-values.yaml and fill out required values. An example can be located in the Bitwarden repository. We recommend that the following values be adjusted for your setup:

Once your values.yaml file has been configured, upgrade the release to a new chart by running:

Bash
helm upgrade sm-operator bitwarden/sm-operator -i --debug -n sm-operator-system --create-namespace --values my-values.yaml
See Also
Map a federated index to an AWS Glue Data Catalog table dataset

This command installs or upgrades a release with the name sm-operator, in the namespace sm-operator-system, with the values from my-values.yaml.

To synchronize secrets stored in Bitwarden Secrets Manager into Kubernetes secrets, we must create a BitwardenSecret object.

1. Create a Kubernetes secret to authenticate with Secrets Manager:
   

   Bash
   kubectl create secret generic bw-auth-token -n <YOUR_NAMESPACE> --from-literal=token="<TOKEN_HERE>"

   advertencia

   This command is recorded in your shell history. To avoid exposing access token data, consider deploying with an ephemeral pipeline agent.

The BitwardenSecret object is the synchronization setting that will be used by the operator to create and synchronize a Kubernetes secret. The Kubernetes secret belongs to a namespace and will be injected with the data that the Secrets Manager machine account has access to.

Example BitwardenSecret deployment with custom mapping:

Bash
cat <<EOF | kubectl apply -n <YOUR_NAMESPACE> -f -apiVersion: k8s.bitwarden.com/v1kind: BitwardenSecretmetadata: labels: app.kubernetes.io/name: bitwardensecret app.kubernetes.io/instance: bitwardensecret-sample app.kubernetes.io/part-of: sm-operator app.kubernetes.io/managed-by: kustomize app.kubernetes.io/created-by: sm-operator name: bitwardensecret-samplespec: organizationId: "a08a8157-129e-4002-bab4-b118014ca9c7" secretName: bw-sample-secret map: - bwSecretId: 6c230265-d472-45f7-b763-b11b01023ca6 secretKeyName: test__secret__1 - bwSecretId: d132a5ed-12bd-49af-9b74-b11b01025d58 secretKeyName: test__secret__2 authToken: secretName: bw-auth-token secretKey: tokenEOF

In the BitwardenSecret deployment example, the custom map element is optional.

To make generated secrets easier to use, you can create a map of Bitwarden Secrets IDs to Kubernetes secret keys. The generated secret will replace the Bitwarden Secret IDs with the mapped name you provide.

Available map settings:

Bash
apiVersion: apps/v1kind: Deploymentmetadata: name: my-deployment labels: app: my-deploymentspec: selector: matchLabels: app: my-deployment template: metadata: labels: app: my-deployment spec: containers: - name: my-deployment image: <some-image> imagePullSecrets: - name: <my-secret-name> envFrom: - secretRef: name: bw-sample-secret