Container Secret Injection Tools

External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets.

OpenBao is a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.

Vault is a centralized secrets management platform designed to secure, store, and control access to sensitive credentials such as API keys, passwords, certificates, and encryption keys. At its core, the system employs a barrier-based cryptographic sealing mechanism that requires an unseal process to decrypt internal storage, ensuring that sensitive data remains protected. It provides identity-based access control to manage granular permissions across distributed infrastructure, effectively centralizing security policies and authentication for both human and machine workloads. What distinguish

CyberArk Conjur automatically secures secrets used by privileged users and machine identities

The Secrets Store Container Storage Interface driver is a Kubernetes storage plugin that enables pods to mount sensitive data from external secret management services directly into container volumes. By utilizing the standard container storage interface, it allows applications to access credentials as files within the file system, ensuring that sensitive information is held in memory rather than persisted to the node disk. The driver distinguishes itself by providing a unified interface for multi-provider integration, allowing clusters to connect to various external secret management services

This project is a Kubernetes controller that automates the retrieval and injection of secrets from HashiCorp Vault into containerized workloads. By operating as a control loop, it monitors cluster state to deliver sensitive configuration data and authentication tokens directly into application environments, removing the requirement for static credentials. The system distinguishes itself through a sidecar-based injection mechanism that intercepts pod lifecycle events to mount secrets at runtime. It supports dynamic credential provisioning, generating short-lived tokens on demand to reduce the

Microsandbox is a microVM sandbox runtime and hardware-isolated code executor designed for running untrusted code. It functions as an embedded virtual machine manager that allows applications to spawn and control lightweight virtual machines directly within code without the need for a background daemon. The system provides a secure execution environment for AI agents by exposing server controls that allow them to execute tools and manage files. It utilizes standard container image formats and volume workflows to initialize guest virtual machines and implements a secret management mechanism th

This project is a GitHub Action that automates the building and pushing of Docker container images to OCI registries. It functions as a multi-platform container builder and publisher using the Buildx engine to create images compatible with multiple hardware architectures. The tool distinguishes itself through software supply chain security features, including the generation of software bills of materials and provenance attestations to verify image integrity. It optimizes construction speed via remote cache management and supports secure secret injection to prevent sensitive data from persisti

sops-nix is a declarative secret provisioner and management module for NixOS and Home Manager. It enables the storage of encrypted secrets directly in version control and decrypts them into a non-persistent ramfs during system activation to provide plaintext files to services without storing them on disk. The project distinguishes itself through a tight integration with the NixOS activation hook and systemd, allowing it to delay service startup until decryption completes and automatically restart units when secret values are updated. It also provides utilities to transform existing SSH host k

Semaphore is a web interface and API for running and scheduling Ansible playbooks and other infrastructure automation tools. It serves as an infrastructure automation dashboard and DevOps task scheduler for orchestrating deployments. The platform functions as a multi-tool automation hub, providing a centralized dashboard for managing infrastructure as code using Ansible, Terraform, OpenTofu, and Terragrunt. It includes an inventory management tool for organizing target servers and containers, alongside a secret management service for storing sensitive environment variables required during exe

Helmfile is a declarative tool for managing Kubernetes Helm releases across multiple environments. It defines the desired state of releases in version-controlled YAML files and synchronizes the cluster to match that state, acting as both a release manager and a state sync orchestrator. The tool layers environment-specific values, secrets, and lifecycle hooks onto shared release definitions, enabling consistent multi-environment deployments. Helmfile distinguishes itself through several integrated capabilities: it generates separate dependency lockfiles per environment for staged rollout of ch

Sealed Secrets is a Kubernetes secret encryption tool and controller designed for GitOps security. It provides a mechanism to encrypt sensitive data into specialized resources that can be safely stored in public version control systems and decrypted only within a cluster. The system uses an asymmetric encryption manager to seal secrets with a public key, ensuring that only the corresponding private key held within the cluster can unseal them. It includes utilities for security key rotation, secret re-encryption, and offline private key recovery to maintain data access during disaster recovery