dap-secret-webhook

dap-secret-webhook

Overview

dap-secret-webhook is a Kubernetes pod mutating webhook for using CaraML Secrets in Flyte.

When Flyte Secret is used in a Flyte workflow, the created pod that runs the task will be injected with predefined Flyte labels, with the Secret metadata in pod annotations.

DAP Secret Webhook Server will read the Flyte Secret metadata from the annotations and f

• On startup, create a MutatingWebhookConfiguration that calls the webhook server for pod create/delete with the predefined Flyte labels
• Read the Flyte Secret Metadata and fetch the Secret Data from MLP
• Create a k8 Secret resource and mount it as env var to the pod, in an expected format by Flyte Secret Manager

Reference

• Kubernetes Webhook
• Kubernetes Webhook Test
• Flyte Webhook Implement

Prerequisite

• Flyte Native Webhook to be disabled
• MLP
• TLS Server Key/Cert and CA certs generated
• Environment variables configured

Environment Variable

Folder Structure

.        
├── client                  # MLP CLient
├── cmd                     # Entrypoint
├── config                  # Configuration
├── test                    # Test data and mocks
├── webhook                 # Webhook Server
└── README.md