Runtime configuration
Runtime flags and environment variables supported by akv2k8s components
Most installations configure akv2k8s through the Helm chart. The options below are component runtime flags or environment variables that may be useful when troubleshooting or when mapping Helm values to the running pods.
Controller
| Option | Default | Description |
|---|---|---|
--watch-all-namespaces | true | Watch AzureKeyVaultSecret resources in all namespaces. Set to false to watch only the controller runtime namespace. |
--kube-resync-period | 30 | Kubernetes informer resync period in seconds. |
--azure-resync-period | 30 | Azure Key Vault resync period in seconds. |
AUTH_TYPE | azureCloudConfig | Key Vault authentication mode. Supported values include azureCloudConfig, environment, and environment-azidentity. |
OBJECT_LABELS | empty | Label selector used to make a controller handle only matching AzureKeyVaultSecret objects. |
METRICS_ENABLED | false | Enables the controller /metrics endpoint. |
HTTP_PORT | 9000 | Port for health and metrics endpoints. |
Env-Injector Webhook
| Option | Default | Description |
|---|---|---|
AUTH_TYPE | cloudConfig | Key Vault authentication mode. Supported values include azureCloudConfig, environment, and environment-azidentity. |
USE_AUTH_SERVICE | true | Enables the auth service used by injected application containers. |
METRICS_ENABLED | false | Enables webhook metrics. |
AZUREKEYVAULT_ENV_IMAGE | spvest/azure-keyvault-env:latest | Image used by the init container that copies the env executable. |
WEBHOOK_CONTAINER_IMAGE_PULL_POLICY | IfNotPresent | Pull policy for the env executable init container. |
WEBHOOK_INIT_CONTAINER_REQUESTS_CPU | 5m | CPU request for the env executable init container. |
WEBHOOK_INIT_CONTAINER_REQUESTS_MEMORY | 32Mi | Memory request for the env executable init container. |
WEBHOOK_INIT_CONTAINER_LIMITS_MEMORY | 32Mi | Memory limit for the env executable init container. |
WEBHOOK_CONTAINER_SECURITY_CONTEXT_READ_ONLY | false | Sets readOnlyRootFilesystem on the env executable init container. |
WEBHOOK_CONTAINER_SECURITY_CONTEXT_NON_ROOT | false | Sets runAsNonRoot on the env executable init container. |
WEBHOOK_CONTAINER_SECURITY_CONTEXT_PRIVILEGED | true | Sets privileged on the env executable init container. |
WEBHOOK_CONTAINER_SECURITY_CONTEXT_ALLOW_PRIVILEGE_ESCALATION | unset | Sets allowPrivilegeEscalation on the env executable init container when provided. |
WEBHOOK_CONTAINER_SECURITY_CONTEXT_USER_UID | unset | Sets runAsUser on the env executable init container when provided. |
WEBHOOK_CONTAINER_SECURITY_CONTEXT_GROUP_GID | unset | Sets runAsGroup on the env executable init container when provided. |
WEBHOOK_CONTAINER_SECURITY_CONTEXT_SECCOMP_RUNTIME_DEFAULT | unset | Sets a RuntimeDefault seccomp profile on the env executable init container when true. |
Injected init-container security context
These WEBHOOK_CONTAINER_SECURITY_CONTEXT_* variables configure the
copy-azurekeyvault-env init container that the webhook adds to an application
Pod with injected Key Vault environment variables. They do not configure the
Env-Injector webhook Pod or the application containers.
The injected init container always drops all Linux capabilities. The webhook
does not change the Pod-level securityContext, so existing Pod-level settings
remain under workload ownership.
By default, the injected init container is privileged and allows a writable root
filesystem and root execution. For a restricted workload policy, explicitly set
the variables below to values compatible with the image and its mounted
/azure-keyvault/ directory:
env:
- name: WEBHOOK_CONTAINER_SECURITY_CONTEXT_PRIVILEGED
value: "false"
- name: WEBHOOK_CONTAINER_SECURITY_CONTEXT_READ_ONLY
value: "true"
- name: WEBHOOK_CONTAINER_SECURITY_CONTEXT_NON_ROOT
value: "true"
- name: WEBHOOK_CONTAINER_SECURITY_CONTEXT_ALLOW_PRIVILEGE_ESCALATION
value: "false"
- name: WEBHOOK_CONTAINER_SECURITY_CONTEXT_USER_UID
value: "65534"
- name: WEBHOOK_CONTAINER_SECURITY_CONTEXT_GROUP_GID
value: "65534"
- name: WEBHOOK_CONTAINER_SECURITY_CONTEXT_SECCOMP_RUNTIME_DEFAULT
value: "true"ALLOW_PRIVILEGE_ESCALATION, USER_UID, and GROUP_GID are left unset unless
their variables are provided. Setting
WEBHOOK_CONTAINER_SECURITY_CONTEXT_SECCOMP_RUNTIME_DEFAULT to false or
leaving it unset does not add a seccomp profile.
Injected Application Containers
| Option | Default | Description |
|---|---|---|
ENV_INJECTOR_DISABLE_AUTH_SERVICE | false | Set to true on a specific application container to disable auth service use for that container only. |
ENV_INJECTOR_LOG_LEVEL | info | Log level for the env executable running inside the application container. |
ENV_INJECTOR_LOG_FORMAT | fmt | Log format for the env executable. |
ENV_INJECTOR_RETRIES | 3 | Number of retry attempts when fetching secrets. |
ENV_INJECTOR_WAIT_BEFORE_RETRY | 3 | Seconds to wait between retry attempts. |
ENV_INJECTOR_DISABLE_AUTH_SERVICE is useful when the Env-Injector auth service is enabled globally, but one workload should authenticate directly with its own Azure identity or environment-based credentials.