vault-env

packaged by Chainguard

Chainguard Container for vault-env

Minimalistic init system for containers with Hashicorp Vault secrets support

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/vault-env:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

This image is comparable to the bank-vaults/vault-env image available from GHCR. Switching to the Chainguard image should not require any changes to your existing setup. The official vault-env is released with an Alpine image, which includes busybox and other utilities and libraries. However, the Chainguard image contains only the minimum set of tools and dependencies needed to function. This means it doesn't include things like a package manager. The default user in the Chainguard image is ran under UID 65532.

Getting Started

Applying the manifests from the following documentation assumes an existing Vault deployment on your cluster.

The following instructions reference both the vault-env image and the vault-secrets-webhook image. vault-secrets-webhook indirectly depends on vault-env when working with container-based workloads by injecting that image into pods as init containers. These instructions use both images from the Chainguard registry.

vault-env is intended to be used in conjunction with bank-vaults/vault-secrets-webhook but, as noted in their documentation, can be used as standalone.

To deploy in conjuction with vault-secrets-webhook, you can follow the Helm chart documentation for vault-secrets-webhook. The only change that needs to occur to the instructions is to adjust the image repository and tag. For example, the modified helm command from their documentation would look like:

helm install vswh --namespace vswh --wait oci://ghcr.io/bank-vaults/helm-charts/vault-secrets-webhook --create-namespace --set image.repository=cgr.dev/chainguard/vault-secrets-webhook,image.tag=latest,vaultEnv.repository=cgr.dev/chainguard/vault-env,vaultEnv.tag=latest

Alternatively, a values.yaml configuration file can be used to deploy the helm chart:

cat <<EOF > values.yaml
    image:
      repository: cgr.dev/chainguard/vault-secrets-webhook
      tag: latest
    vaultEnv:
      repository: cgr.dev/chainguard/vault-env
      tag: latest
EOF

Using that values.yaml file, you would deploy via helm with this command:

helm install vswh --namespace vswh --wait oci://ghcr.io/bank-vaults/helm-charts/vault-secrets-webhook --create-namespace -f values.yaml

Next, deploy your resources with values to be mutated as described in the documentation.

Documentation and Resources

• Vault Mutating Webhook.

What are Chainguard Containers?

Chainguard Containers are minimal container images that are secure by default.

In many cases, the Chainguard Containers tagged as :latest contain only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager. Chainguard Containers are built with Wolfi, our Linux undistro designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a -dev variant.

Although the -dev container image variants have similar security features as their more minimal versions, they feature additional software that is typically not necessary in production environments. We recommend using multi-stage builds to leverage the -dev variants, copying application artifacts into a final minimal container that offers a reduced attack surface that won’t allow package installations or logins.

Learn More

To better understand how to work with Chainguard Containers, please visit Chainguard Academy and Chainguard Courses.

In addition to Containers, Chainguard offers VMs and Libraries. Contact Chainguard to access additional products.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.