Open source Project note

Vaultwarden ESO Provider

Use selected vault items in Kubernetes, while keeping secret reconciliation with ESO.

The provider authenticates with a vault, decrypts permitted item fields and returns them to External Secrets Operator. ESO then owns the creation and refresh of Kubernetes Secrets. The Rust service does not need Kubernetes API permissions or the Bitwarden CLI at runtime. That reduces runtime machinery, while making protocol compatibility an explicit responsibility of the provider.

VaultwardenA dedicated vault account defines the upstream trust boundary.
Webhook providerAuthenticate, unlock and resolve item fields within the selector policy.
ESO → KubernetesExternal Secrets Operator reconciles the resulting Kubernetes Secret.

The provider handles decrypted values. Selector policy limits callers, not a compromised provider: account isolation and network boundaries still matter.

Availability

This is a pre-1.0, single-maintainer integration under the Apache 2.0 license. Current release qualification covers Vaultwarden; Bitwarden Cloud acceptance remains unverified. It is not Bitwarden Secrets Manager. Shared organization items and attachments are unsupported. Review the current release notes and threat model before installation.