Annotations Reference¶
cloudtaser uses Kubernetes pod annotations under the cloudtaser.io/ prefix to control wrapper injection, secret fetching, eBPF enforcement, and S3 proxy behaviour. Annotations are evaluated by the mutating admission webhook at pod creation time.
cloudtaser uses Kubernetes annotations to control which workloads are protected. In an enrolled namespace, the canonical pod trigger requests wrapper injection. Application compatibility depends on the runtime delivery contract. The operator's mutating webhook evaluates annotations at pod creation time, ensuring consistent policy enforcement across all protected workloads.
Injection Control¶
secretstore.cloudtaser.io/inject¶
| Required | Yes |
| Values | "true" or "false" |
| Default | Not set (no injection) |
Enables or disables cloudtaser wrapper injection for the pod. The webhook only mutates pods where this annotation is explicitly set to "true".
The workload namespace must also carry the label
cloudtaser.io/inject=true. Namespace enrollment and the pod annotation are
separate requirements: an annotated pod in an unenrolled namespace does not
call the workload webhooks. See namespace enrollment.
Annotation values must be strings
Kubernetes annotation values are always strings. Use "true" (quoted) in YAML, not the bare boolean true.
cloudtaser.io/config¶
| Required | No |
| Values | Name of a CloudTaserConfig CR in the same namespace |
| Default | Not set |
References a CloudTaserConfig custom resource by name. When set, the webhook reads secret store address, role, secret paths, and env mappings from the CR instead of individual annotations. This is the recommended approach for production workloads.
metadata:
annotations:
secretstore.cloudtaser.io/inject: "true"
cloudtaser.io/config: "my-app-config"
Config reference vs inline annotations
When cloudtaser.io/config is set, individual secret-store/secret annotations on the pod are ignored. The CR is the single source of truth. This keeps your Deployment manifests clean and allows config changes without redeploying.
cloudtaser.io/containers¶
| Required | No |
| Values | Comma-separated container names |
| Default | First container in the pod |
Restricts which containers in the pod receive the injected wrapper. By default, the wrapper is injected into the first container only. Use this annotation to target specific containers when a pod runs multiple containers and only some need secrets.
Default installations currently deny exec bootstrap in protected containers,
including kubelet exec probes. Use equivalent httpGet, tcpSocket, or grpc
probes, or omit a container that requires exec probes from this list. Omitted
containers receive no wrapper protection. See the exec limitation.
metadata:
annotations:
secretstore.cloudtaser.io/inject: "true"
cloudtaser.io/containers: "api,worker"
Secret Store Configuration¶
Canonical name is secretstore-*
The annotations in this section are named cloudtaser.io/secretstore-<suffix>. The operator continues to accept the legacy cloudtaser.io/vault-<suffix> spellings as aliases (Phase 1 of annotation and environment compatibility). Phase 3 will remove the aliases; new manifests should use secretstore-* exclusively.
cloudtaser.io/secretstore-address¶
| Required | Yes (unless using config reference) |
| Values | URL (including scheme and port) |
| Default | Not set |
| Legacy alias | cloudtaser.io/vault-address |
The address of the EU-hosted secret store (OpenBao or HashiCorp Vault). Must be reachable from the pod network. TLS is strongly recommended for production.
cloudtaser.io/secretstore-role¶
| Required | Yes (unless using config reference) |
| Values | Kubernetes auth role name registered in the secret store |
| Default | Not set |
| Legacy alias | cloudtaser.io/vault-role |
The role used for Kubernetes service account authentication against the secret store. The role must be configured in the secret store to accept the pod's service account token.
cloudtaser.io/secretstore-auth-method¶
| Required | No |
| Values | "kubernetes", "token" |
| Default | "kubernetes" |
| Legacy alias | cloudtaser.io/vault-auth-method |
The authentication method used to obtain a secret store token. The default is
kubernetes for direct-store authentication. Broker envelope delivery requires
cloudtaser.io/secretstore-auth-method: "token" and a CloudTaserPolicy with
non-empty vaultPaths. On that path the broker supplies the envelope; no
VAULT_TOKEN is needed. See the customer procedure.
Token auth
In direct-store mode only, when using "token", the wrapper expects a valid secret-store token in the VAULT_TOKEN environment variable (the OpenBao/HashiCorp Vault SDK convention - kept for backward compatibility with upstream tooling). This direct-store option is primarily useful for local development and testing. Broker envelope mode uses the separate contract above.
cloudtaser.io/secretstore-tls-skip-verify¶
| Required | No |
| Values | "true" or "false" |
| Default | "false" |
| Legacy alias | cloudtaser.io/vault-tls-skip-verify |
Disables TLS certificate verification when connecting to the secret store. This should only be used in development or testing environments.
Do not use in production
Skipping TLS verification defeats the purpose of EU data sovereignty. An attacker performing a man-in-the-middle attack could intercept secrets in transit. Always use properly signed certificates in production.
Secret Configuration¶
secretstore.cloudtaser.io/secret-paths¶
| Required | Yes (unless using config reference) |
| Values | Comma-separated KV paths in the secret store |
| Default | Not set |
One or more KV secret paths in the secret store to fetch. The wrapper retrieves all key-value pairs from each path and makes them available to the application process.
secretstore.cloudtaser.io/env-map¶
| Required | No |
| Values | Field-to-variable mappings (see format below) |
| Default | Not set (all fields exposed with original names) |
Maps individual secret-store fields to specific environment variable names. Each path's mappings are separated by semicolons, and within a path, individual field mappings use the field=VAR format separated by commas.
Format: field1=VAR1,field2=VAR2;field3=VAR3,field4=VAR4
- Commas separate field mappings within the same secret path
- Semicolons separate mapping groups corresponding to each path in
secret-paths
secretstore.cloudtaser.io/secret-paths: "secret/data/myapp/db,secret/data/myapp/stripe"
secretstore.cloudtaser.io/env-map: "username=DB_USER,password=DB_PASS;api_key=STRIPE_KEY"
In this example:
- From
secret/data/myapp/db: fieldusernamebecomesDB_USER, fieldpasswordbecomesDB_PASS - From
secret/data/myapp/stripe: fieldapi_keybecomesSTRIPE_KEY
Unmapped fields
Fields not listed in the env-map are still available to the application under their original secret-store field names. The env-map provides renaming, not filtering.
Rotation¶
cloudtaser.io/rotation¶
| Required | No |
| Values | "restart", "sighup", "none" |
| Default | "restart" |
Controls what the wrapper does with the application process when it re-fetches secrets (see the warning below for what triggers a re-fetch). Without the annotation the operator injects CLOUDTASER_ROTATION=restart. CloudTaserConfig has no rotation field, so this annotation is the only per-workload setting. Pods injected through a SecretMapping always get restart, because that path does not read pod annotations.
| Value | Behaviour |
|---|---|
"restart" |
The wrapper terminates the application process and re-launches it with the new secrets. Suitable for applications that only read environment variables at startup. |
"sighup" |
The wrapper sends SIGHUP to the application process after updating secrets in memory. The application must handle SIGHUP to re-read its configuration. |
"none" |
Secrets are fetched once at startup. No automatic rotation. The pod must be restarted to pick up new secrets. |
Changes to static KV secrets are not detected automatically
The wrapper applies the rotation strategy when it re-fetches secrets. It does that in two cases: when renewal of a leased secret (for example dynamic database credentials) fails and the wrapper re-fetches that path, and when the wrapper process itself receives SIGHUP. In direct-Vault mode (wrapper v0.2.196 or later) it also polls the KV-v2 data path and re-fetches when metadata.version changes; in broker/beacon mode a new KV value still needs SIGHUP or a restart.
After changing a static KV secret, restart the affected workloads with cloudtaser-cli target rotate, or send SIGHUP to the wrapper (PID 1 in the container) to re-fetch every configured path and apply the selected strategy.
eBPF Enforcement¶
cloudtaser.io/ebpf¶
The default is integration enabled. Verify node-agent readiness and the active enforcement path for every protected workload.
An explicit false annotation is refused by default. Authorization requires the cluster administrator's --ebpf-allow-namespace-opt-out setting (ebpf.allowNamespaceOptOut in Helm), an explicitly non-enforcing namespace policy, and no enforcing policy veto. The exception removes runtime eBPF protection and emits warnings; it is not a protected deployment recommendation. Source-derived authorization rules are not a measured exception qualification.
S3 Proxy¶
cloudtaser.io/s3-proxy¶
| Required | No |
| Values | "true" or "false" |
| Default | "false" |
Injects the cloudtaser S3 encryption proxy as an additional sidecar container. The proxy transparently encrypts objects before they reach cloud storage using keys held in your EU secret store (the current implementation uses the OpenBao/HashiCorp Vault Transit engine for key wrapping).
cloudtaser.io/s3-proxy-endpoint¶
| Required | No (when using s3-proxy: "true") |
| Values | S3-compatible endpoint URL |
| Default | AWS S3 default endpoint |
The upstream S3-compatible endpoint the proxy forwards requests to after encryption.
cloudtaser.io/s3-proxy-region¶
| Required | No |
| Values | AWS region string |
| Default | "eu-west-1" |
The AWS region for S3 requests.
cloudtaser.io/s3-proxy-transit-key¶
| Required | Yes (when using s3-proxy: "true") |
| Values | OpenBao Transit key name |
| Default | Not set |
The name of the Transit encryption key in OpenBao used to wrap per-object data encryption keys.
cloudtaser.io/s3-proxy-transit-mount¶
| Required | No |
| Values | OpenBao Transit mount path |
| Default | "transit" |
OpenBao mount path for the Transit secrets engine.
Status (Read-Only)¶
cloudtaser.io/status¶
| Set by | Webhook (read-only) |
| Values | "injected" |
Set by the mutating admission webhook after processing the pod. Do not set this annotation manually.
| Value | Meaning |
|---|---|
"injected" |
Wrapper injection was successful. |
Complete Annotation Reference Table¶
| Annotation | Required | Default | Description |
|---|---|---|---|
secretstore.cloudtaser.io/inject |
Yes | -- | Enable wrapper injection |
cloudtaser.io/config |
No | -- | Reference a CloudTaserConfig CR |
cloudtaser.io/secretstore-address |
Conditional | -- | Secret store endpoint URL (legacy alias: cloudtaser.io/vault-address) |
cloudtaser.io/secretstore-role |
Conditional | -- | Kubernetes auth role in the secret store (legacy alias: cloudtaser.io/vault-role) |
cloudtaser.io/secretstore-auth-method |
No | kubernetes |
Auth method (legacy alias: cloudtaser.io/vault-auth-method) |
cloudtaser.io/secretstore-tls-skip-verify |
No | false |
Skip TLS verification (legacy alias: cloudtaser.io/vault-tls-skip-verify) |
secretstore.cloudtaser.io/secret-paths |
Conditional | -- | KV paths in the secret store |
secretstore.cloudtaser.io/env-map |
No | -- | Field-to-env mappings |
cloudtaser.io/rotation |
No | restart |
Rotation strategy |
cloudtaser.io/containers |
No | First container | Target containers |
cloudtaser.io/ebpf |
No | Derived from operator integration policy | Explicit false requires the cluster gate and non-enforcing namespace authority described above. |
cloudtaser.io/s3-proxy |
No | false |
Inject S3 proxy sidecar |
cloudtaser.io/s3-proxy-endpoint |
No | AWS default | S3 upstream endpoint |
cloudtaser.io/s3-proxy-region |
No | eu-west-1 |
S3 region |
cloudtaser.io/s3-proxy-transit-key |
Conditional | -- | Transit encryption key name (OpenBao/HashiCorp Vault Transit engine) |
cloudtaser.io/s3-proxy-transit-mount |
No | transit |
Transit mount path (OpenBao/HashiCorp Vault Transit engine) |
cloudtaser.io/status |
-- | -- | Read-only, set by webhook |
"Conditional" means the annotation is required when not using a cloudtaser.io/config reference, or (for S3 fields) when s3-proxy is enabled.
Full Examples¶
Inline Annotations¶
All configuration specified directly on the Deployment:
apiVersion: apps/v1
kind: Deployment
metadata:
name: payment-service
namespace: production
spec:
replicas: 3
selector:
matchLabels:
app: payment-service
template:
metadata:
labels:
app: payment-service
annotations:
secretstore.cloudtaser.io/inject: "true"
cloudtaser.io/secretstore-address: "https://vault.eu-west-1.example.com:8200"
cloudtaser.io/secretstore-role: "payment-service"
secretstore.cloudtaser.io/secret-paths: "secret/data/payments/db,secret/data/payments/stripe"
secretstore.cloudtaser.io/env-map: "username=DB_USER,password=DB_PASS;api_key=STRIPE_SECRET_KEY"
cloudtaser.io/rotation: "sighup"
cloudtaser.io/ebpf: "true"
cloudtaser.io/containers: "api"
spec:
serviceAccountName: payment-service
containers:
- name: api
image: eu.gcr.io/myproject/payment-service:v2.1.0
ports:
- containerPort: 8080
- name: metrics
image: eu.gcr.io/myproject/metrics-exporter:v1.0.0
ports:
- containerPort: 9090
In this example, only the api container receives secret injection. The metrics container is left untouched.
CloudTaserConfig Reference¶
Configuration managed through a CR, keeping the Deployment clean:
apiVersion: api.cloudtaser.io/v1alpha1
kind: CloudTaserConfig
metadata:
name: payment-service
namespace: production
spec:
secretStore:
address: "https://vault.eu-west-1.example.com:8200"
role: "payment-service"
secretPaths:
- "secret/data/payments/db"
- "secret/data/payments/stripe"
# Same format as secretstore.cloudtaser.io/env-map: one group per secretPaths entry, in order.
envMap: "username=DB_USER,password=DB_PASS;api_key=STRIPE_SECRET_KEY"
Legacy top-level vaultAddress / vaultRole
Existing manifests using the flat spec.vaultAddress / spec.vaultRole / spec.vaultAuthPath fields continue to work - the operator's EffectiveSecretStore resolver prefers spec.secretStore.* when set, falling back to the deprecated top-level fields. Phase 3 removes the deprecated fields; new manifests should use spec.secretStore.* exclusively.
apiVersion: apps/v1
kind: Deployment
metadata:
name: payment-service
namespace: production
spec:
replicas: 3
selector:
matchLabels:
app: payment-service
template:
metadata:
labels:
app: payment-service
annotations:
secretstore.cloudtaser.io/inject: "true"
cloudtaser.io/config: "payment-service"
cloudtaser.io/rotation: "sighup"
cloudtaser.io/ebpf: "true"
cloudtaser.io/containers: "api"
spec:
serviceAccountName: payment-service
containers:
- name: api
image: eu.gcr.io/myproject/payment-service:v2.1.0
ports:
- containerPort: 8080
- name: metrics
image: eu.gcr.io/myproject/metrics-exporter:v1.0.0
ports:
- containerPort: 9090
Recommended for production
Using a CloudTaserConfig reference separates secret configuration from workload deployment. Platform teams can manage secret-store paths and mappings independently of application deployment manifests.
S3 Proxy Injection¶
Adding client-side encryption to an application that uses S3:
apiVersion: apps/v1
kind: Deployment
metadata:
name: document-store
namespace: production
spec:
replicas: 2
selector:
matchLabels:
app: document-store
template:
metadata:
labels:
app: document-store
annotations:
secretstore.cloudtaser.io/inject: "true"
cloudtaser.io/secretstore-address: "https://vault.eu-west-1.example.com:8200"
cloudtaser.io/secretstore-role: "document-store"
secretstore.cloudtaser.io/secret-paths: "secret/data/docstore/db"
cloudtaser.io/s3-proxy: "true"
cloudtaser.io/s3-proxy-endpoint: "https://s3.eu-west-1.amazonaws.com"
cloudtaser.io/s3-proxy-region: "eu-west-1"
cloudtaser.io/s3-proxy-transit-key: "docstore-dek"
cloudtaser.io/ebpf: "true"
spec:
serviceAccountName: document-store
containers:
- name: app
image: eu.gcr.io/myproject/document-store:v1.3.0
env:
- name: AWS_ENDPOINT_URL
value: "http://localhost:8099"
ports:
- containerPort: 8080
The application points its S3 client at localhost:8099 (the injected proxy), and the proxy handles encryption transparently before forwarding to the real S3 endpoint.
Published annotation and marker inventory¶
| Input name | Consumer (inferred from published source) |
|---|---|
capability.cloudtaser.io/bpffs-writable |
internal/flags/context.go (source key) |
capability.cloudtaser.io/lsm-stack |
internal/flags/context.go (source key) |
cloudtaser.io/admission-inputs |
internal/webhook/admission_inputs.go (source key); internal/webhook/annotation_validation.go (source key) |
cloudtaser.io/agent-health-tls |
internal/healthcert/issuer.go (source key) |
cloudtaser.io/allow-exec |
internal/webhook/annotation_validation.go (source key); internal/webhook/exec_validator.go (source key) |
cloudtaser.io/allow-privileged |
internal/webhook/annotation_validation.go (source key); internal/webhook/pod_security_validator.go (source key) |
cloudtaser.io/allow-share-process-namespace |
internal/webhook/annotation_validation.go (source key); internal/webhook/pod_security_validator.go (source key) |
cloudtaser.io/attestation |
internal/attestation/keyserver.go (source key) |
cloudtaser.io/confidential-vm |
internal/attestation/collector.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/confidential_vm.go (source key) |
cloudtaser.io/config |
internal/controller/cloudtaserconfig_controller.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/containers |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/correlation-id |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/cosign-verified |
internal/webhook/annotation_validation.go (source key); internal/webhook/image_verifier.go (source key) |
cloudtaser.io/db-proxy |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/db-proxy-blind-index-columns |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/db-proxy-dek-kv-path |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/db-proxy-encrypt-columns |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/db-proxy-listen-port |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/db-proxy-tls |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/db-proxy-tls-skip-verify |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/db-proxy-transit-key |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/db-proxy-transit-mount |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/db-proxy-upstream |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/dek-unwrap |
internal/broker/dek_unwrap.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/dns-probe |
internal/controller/dnshealth.go (source key) |
cloudtaser.io/dns-probe-id |
internal/controller/dnshealth.go (source key) |
cloudtaser.io/ebpf |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/ebpf-health-addr |
internal/attestation/collector.go (source key); internal/controller/cloudtaserconfig_controller.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/ebpf-integration |
internal/webhook/ebpf_optout_policy.go (source key) |
cloudtaser.io/encrypt-pvc |
internal/webhook/annotation_validation.go (source key); internal/webhook/volume_shield.go (source key) |
cloudtaser.io/enforcement-mode |
api/v1alpha1/cloudtaserpolicy_types.go (source key); internal/webhook/annotation_validation.go (source key) |
cloudtaser.io/env-allowlist |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/env-map |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/image-verification-warning |
internal/webhook/annotation_validation.go (source key); internal/webhook/image_verifier.go (source key) |
cloudtaser.io/image-verified |
internal/webhook/annotation_validation.go (source key); internal/webhook/image_verifier.go (source key) |
cloudtaser.io/inject |
internal/attestation/collector.go (source key); internal/controller/admission_enrollment_controller.go (source key); internal/controller/daemonset_controller.go (source key); internal/controller/deployment_controller.go (source key); internal/controller/networkpolicy_controller.go (source key); internal/controller/statefulset_controller.go (source key); internal/controller/webhook_expected.go (source key); internal/vanta/sync.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/injected |
internal/attestation/scheduler.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/injection |
internal/controller/networkpolicy_controller.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/injection-token |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/openbao-client |
internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/operator-introduction |
internal/introductionapi/protocol.go (source key) |
cloudtaser.io/operator-namespace |
cmd/cloudtaser-hosted-cleanup-plan/policies.go (source key); internal/controller/networkpolicy_controller.go (source key) |
cloudtaser.io/preserve-fsgroup |
internal/webhook/annotation_validation.go (source key); internal/webhook/volume_shield.go (source key) |
cloudtaser.io/protected |
internal/controller/networkpolicy_controller.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/pvc-chunk-size-kb |
internal/webhook/annotation_validation.go (source key); internal/webhook/volume_shield.go (source key) |
cloudtaser.io/pvc-transit-key |
internal/webhook/annotation_validation.go (source key); internal/webhook/volume_shield.go (source key) |
cloudtaser.io/ready-probe |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/require-image-verification |
internal/webhook/annotation_validation.go (source key); internal/webhook/image_verifier.go (source key) |
cloudtaser.io/revocation-grace |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/rotation |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/s3-proxy |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/s3-proxy-allow-insecure-endpoint |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/s3-proxy-dek-kv-path |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/s3-proxy-endpoint |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/s3-proxy-provider-ca-configmap |
internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/s3-proxy-provider-ca-configmap-key |
internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/s3-proxy-region |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/s3-proxy-transit-key |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/s3-proxy-transit-mount |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/secret-backend |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/secret-envelope |
internal/broker/proxy.go (source key); internal/webhook/secret_fetch_token.go (source key) |
cloudtaser.io/secret-fetch |
internal/broker/proxy.go (source key); internal/webhook/secret_fetch_token.go (source key) |
cloudtaser.io/secret-paths |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/secretstore-address |
internal/controller/pod_controller.go (source key); internal/controller/secretstore_egress.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/secretstore-auth-method |
internal/controller/pod_controller.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/secretstore-auth-path |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/secretstore-backend |
internal/webhook/annotation_validation.go (source key); internal/webhook/vault_backend.go (source key) |
cloudtaser.io/secretstore-ca-pem |
internal/webhook/direct_vault_defaults.go (source key) |
cloudtaser.io/secretstore-ca-subject |
internal/attestation/collector.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/secretstore-role |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/secretstore-skip-verify |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/secretstore-tls-skip-verify |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/source-introduction-migrated |
internal/certs/broker_ca_configmap.go (source key) |
cloudtaser.io/status |
internal/controller/admission_enrollment_controller.go (source key); internal/controller/cloudtaserconfig_controller.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/strict-bpf-agent-generation |
internal/attestation/strict_bpf_policy.go (source key) |
cloudtaser.io/strict-bpf-agent-pod-uid |
internal/attestation/strict_bpf_policy.go (source key) |
cloudtaser.io/strict-bpf-attestation-counter |
internal/attestation/strict_bpf_policy.go (source key) |
cloudtaser.io/strict-bpf-attestation-time |
internal/attestation/strict_bpf_policy.go (source key) |
cloudtaser.io/strict-bpf-mode |
internal/attestation/strict_bpf_policy.go (source key) |
cloudtaser.io/strict-bpf-policy-hash |
internal/attestation/strict_bpf_policy.go (source key) |
cloudtaser.io/trusted-registries |
internal/webhook/annotation_validation.go (source key); internal/webhook/image_verifier.go (source key) |
cloudtaser.io/unseal-keyshare |
internal/broker/unseal_keyshare.go (source key); internal/webhook/secret_fetch_token.go (source key) |
cloudtaser.io/vault-address |
internal/controller/pod_controller.go (source key); internal/controller/secretstore_egress.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/vault-auth-method |
internal/controller/pod_controller.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/vault-auth-path |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/vault-backend |
internal/webhook/annotation_validation.go (source key); internal/webhook/vault_backend.go (source key) |
cloudtaser.io/vault-ca-configmap |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/vault-ca-configmap-key |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/vault-ca-subject |
internal/webhook/annotation_validation.go (source key) |
cloudtaser.io/vault-policy-name |
internal/controller/pod_controller.go (source key); internal/webhook/injection_provenance.go (source key); internal/webhook/injection_reapply.go (source key) |
cloudtaser.io/vault-role |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/vault-skip-verify |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/vault-tls-skip-verify |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/vs-broker |
internal/vsbrokeridentity/policy.go (source key) |
cloudtaser.io/vs-dek-provision |
internal/broker/vs_dek_provision.go (source key); internal/webhook/volume_shield.go (source key) |
cloudtaser.io/vs-freshness |
internal/webhook/volume_shield.go (source key) |
cloudtaser.io/vs-io-mode |
internal/webhook/volume_shield.go (source key) |
cloudtaser.io/vs-sidecar |
internal/webhook/volume_shield.go (source key) |
cloudtaser.io/vs-trusted-state |
internal/broker/vs_trusted_state.go (source key); internal/webhook/volume_shield.go (source key) |
cloudtaser.io/wrapper-cpu-limit |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/wrapper-cpu-request |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/wrapper-image |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/wrapper-image-digest |
internal/attestation/collector.go (source key); internal/webhook/annotation_validation.go (source key); internal/webhook/image_digest.go (source key) |
cloudtaser.io/wrapper-memory-limit |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/wrapper-memory-request |
internal/webhook/annotation_validation.go (source key); internal/webhook/sidecar_injector.go (source key) |
cloudtaser.io/wrapper-unseal |
internal/broker/broker.go (source key) |
secretstore.cloudtaser.io/env-map |
internal/webhook/sidecar_injector.go (source key) |
secretstore.cloudtaser.io/inject |
internal/attestation/collector.go (source key); internal/controller/daemonset_controller.go (source key); internal/controller/deployment_controller.go (source key); internal/controller/statefulset_controller.go (source key); internal/vanta/sync.go (source key); internal/webhook/sidecar_injector.go (source key) |
secretstore.cloudtaser.io/secret-paths |
internal/webhook/sidecar_injector.go (source key) |
The inventory comes from the published operator registry and literal consumer keys. It includes inputs, controller outputs, namespace labels and compatibility spellings; listing a key does not authorize a pod to set controller-owned state. Use canonical input spellings and verify the applicable namespace/cluster policy.
Security-sensitive admission exceptions¶
cloudtaser.io/allow-exec grants exec access to the named ServiceAccounts;
cloudtaser.io/allow-privileged and
cloudtaser.io/allow-share-process-namespace relax pod isolation checks.
These are security exceptions requiring administrator review. Their presence is
not evidence of an equivalent protected path. See the exec and upgrade guidance.
Absence of the status annotation does not encode a skipped/error result. Use admission responses, events and logs to diagnose requests.
Canonical pod inputs use secretstore.cloudtaser.io/ for inject, secret-paths
and env-map. Secret-store connection annotations use cloudtaser.io/secretstore-*.
The namespace enrollment label remains cloudtaser.io/inject=true because
that is the published chart selector. Controller-owned cloudtaser.io/injection-*
markers are separate keys. Compatibility aliases remain accepted in the published
operator; no trustworthy future removal date is established here. Do not infer
canonical-path deployment qualification from recognition in source.
Broker and controller-owned inputs¶
These keys are included in the generated published-source inventory above.
| Key | Meaning and authority boundary |
|---|---|
cloudtaser.io/secret-backend |
broker selects broker delivery; this is separate from the operator's own private-material storage backend. Follow the matched Port/broker procedure. |
cloudtaser.io/db-proxy-dek-kv-path |
KV v2 path holding the proxy's wrapped envelope DEK; review store policy and the qualified proxy path. |
cloudtaser.io/db-proxy-tls |
Controls upstream database TLS. Verify certificate trust and the endpoint; key recognition does not qualify secure serving. |
cloudtaser.io/cosign-verified |
Verification marker written/read by controllers; a pod-supplied marker does not establish signature verification. |
cloudtaser.io/injected |
Controller-owned injection marker, also used as a label; do not forge it as a substitute for admission. |
cloudtaser.io/secretstore-skip-verify |
Compatibility TLS-verification control. The older vault spelling remains recognized. Retain certificate verification for protected deployments. |
cloudtaser.io/vs-broker |
Volume Shield internal broker marker; use operator-managed wiring rather than setting it as application authorization. |
Test-plan configuration is not deployment qualification. Use Supported Paths and a matched release run for each proxy or Volume Shield deployment.