Install the aapm-sidecar Injector

the injector is a mutating admission webhook that automatically adds an aapm client container to pods created in labeled namespaces this webhook has cluster wide authorization (clusterrole/clusterrolebinding); because of this, only one instance can run per cluster (identically named cluster scoped resources would conflict) create and label the target namespace the aapm injection=enabled label tells the injector to inject pods in this namespace kubectl create namespace \<target namespace> kubectl label namespace \<target namespace> aapm injection=enabled create the secret file this file defines which secrets the aapm client container will fetch, from which kron pam account, using which token secret file fields field meaning userlabel determines the output filename /keystore/{userlabel} env a free form label secret the account name in kron pam token the kron pam access token (typically in guid format) accpath the account's path within kron pam cat <<'eof' > /tmp/application aapm client yml aapm client poll interval ms 30000 secrets \ userlabel "\<label>" secret "\<account name>" token "\<kron pam token>" accpath "\<account path>" eof kubectl create secret generic aapm client secret \\ \ namespace \<target namespace> \\ \ from file=application aapm client yml=/tmp/application aapm client yml install the injector injector parameters parameter meaning namespace name the injector's own namespace — required, the clusterrolebinding's serviceaccount reference is derived from it aapmconnection directaccessurl kron pam's direct url — required, if missing the sidecar won't start aapmconnection ignorecertificate must be true for the agent connection (due to the self signed certificate) sidecarimage tag the version of the aapm client image to inject use a tag verified to work in your environment — the chart default may not be compatible everywhere (for example, architecture mismatch) helm install kron aapm sidecar kron pam/kron aapm sidecar \\ \ namespace ns sidecar \\ \ create namespace \\ \ set namespace name=ns sidecar \\ \ set aapmconnection agentservice="kron aapm agent ns agent svc cluster local" \\ \ set aapmconnection agentport="8080" \\ \ set aapmconnection directaccessurl="https //\<kron pam server address>" \\ \ set aapmconnection ignorecertificate=true \\ \ set aapmconnection ignoreinterceptorcertificate=false \\ \ set sidecarimage tag="\<verified image tag>" verification kubectl get pods n ns sidecar kubectl logs n ns sidecar deploy/kron aapm sidecar tail=20 success criteria pod is running, logs show webhook server started on port 8443 excluding a pod from injection injection applies to every pod created in a namespace labeled aapm injection=enabled to opt a specific pod out, add the following annotation to the pod template annotations aapm sidecar injector kron com/inject "false" defining multiple secrets more than one entry can be defined under aapm client secrets each entry produces its own file, named after its userlabel aapm client poll interval ms 30000 secrets \ userlabel "db user" secret "\<account name 1>" token "\<kron pam token 1>" accpath "\<account path 1>" \ userlabel "api user" secret "\<account name 2>" token "\<kron pam token 2>" accpath "\<account path 2>" this produces /keystore/db user env and /keystore/api user env how the application reads the secret the aapm client container writes the retrieved secrets into a shared emptydir volume mounted at /keystore the application container in the same pod reads the env file from that path the secrets are refreshed on every polling cycle (poll interval ms, default 30000 ms), so a rotated credential in kron pam reaches the pod without a restart the aapm client secret content is read only at pod startup updating the kubernetes secret doesn't affect running pods — the pod must be deleted and recreated, or the deployment restarted, for the new configuration to take effect each target namespace requires its own aapm client secret a single injector can serve any number of labeled namespaces, but the secret is namespace scoped and isn't copied automatically