Open-sourcing kube-secret-syncer: A Kubernetes operator to sync secrets from AWS Secrets Manager

Published on October 20, 2020

BLOG SecretSyncer

Subscribe for updates

Build better digital experiences with Contentful updates direct to your inbox.

Looking for an efficient, flexible and secure way to sync secrets from AWS Secrets Manager to Kubernetes? We’ve got you covered.

We’re releasing the open source code for Kube-secret-syncer, a Kubernetes operator that syncs secrets from AWS Secrets Manager. This operator improves on existing projects by delivering sophisticated access control, templated fields and caching to reduce costs. For those familiar with the struggles that come from synching secrets between the two, we hope this comes as a welcome solution. 

Securing, auditing and managing your secrets is an administrative task that was made infinitely easier with managed secret stores such as AWS Secret Manager. Its strong access control, secret rotation and log auditing features enable you to meet strong security and compliance requirements.

Problems can arise when synching secrets from AWS Secrets Manager to Kubernetes; this requires a custom solution. Several open source solutions exist, such as Kubernetes External Secrets or AWS Secret Operator, but they lack either in security, caching or flexibility. Especially when you’re synching thousands of secrets, the costs add up.

As a result, our infrastructure team took on the project of developing our take on an operator and built Kube-secret-syncer. Kube-secret-syncer uses caching to retrieve the value of secrets only when they have changed. This feature substantially reduces costs when syncing a large number of secrets. The syncer also enables sophisticated access controls in AWS Secrets Manager using IAM roles. This feature allows more control over what secrets individual Kubernetes namespaces can access. The third feature we introduced was templated fields. Kube-secret-syncer supports templated fields for Kubernetes secrets enabling the use of values from multiple AWS secret manager secrets in one Kubernetes secret.  

Kube-secret-syncer is ready to go, and you can download the source code from Github. We would be very interested in hearing your feedback. Please don’t hesitate to get in touch and let us know how it goes

Subscribe for updates

Build better digital experiences with Contentful updates direct to your inbox.

Meet the authors

Yann Hamon

Yann Hamon

Reliability & Infrastructure Engineer

Contentful

Reliability Engineer - Infrastructure at Contentful

Related articles

Migrating your website to Contentful? This article will line out the steps you need to take to ensure your migration process is as smooth as possible.
Guides

Migrating to Contentful from Wordpress is far easier than it may seem

July 10, 2024

Explore command line interfaces to  control your applications directly, automate your systems, and accelerate with flexibility like a power user.
Guides

Command line interface: A beginner's guide to what it is and how it works

April 16, 2025

Next.js redirects are an important function for any frontend application. This tutorial demonstrates the four ways that you can create a page redirect in Next.js.
Guides

How to create a Next.js redirect in 4 ways (with examples)

September 20, 2024

Contentful Logo 2.5 Dark

Ready to start building?

Put everything you learned into action. Create and publish your content with Contentful — no credit card required.

Get started