What the Kubernetes connector is

The connector is a small operator you run in your own cluster. It holds a kyvlt.sh service token, reads one environment, and writes what it finds into a Kubernetes Secret. It repeats on an interval, so a value you change in kyvlt.sh reaches your workloads without anybody copying it.

Your cluster asks; kyvlt.sh never reaches in

Most tools in this category take credentials for your cluster and push values into it. This one runs beside your workloads and asks for what it needs.

kyvlt.sh therefore stores no kubeconfig, holds no credential for your cluster, and needs no network path to your API server. The only credential involved is a service token, scoped to one environment at read access, and revoking it stops the flow on the connector’s next request.

One environment becomes one Secret

A Kubernetes Secret is a map, not a single value. One environment becomes one Secret holding every key in it. An environment with DATABASE_URL, REDIS_URL and STRIPE_KEY becomes one object with those three entries, which a pod reads in one go:

envFrom:
  - secretRef:
      name: kyvlt-cayote-studio-production

Add a key in kyvlt.sh and it appears. Remove one and it goes.

Values travel one way

Nothing in your cluster can change a secret in kyvlt.sh. The operator has no write operation at all.

The Secret is a projection: a copy that is kept current, never a source. Edit it with kubectl and the connector reports the drift rather than silently overwriting or accepting the change.

Idle costs nothing

Before reading any value the operator asks whether the environment has changed, comparing key names and change times rather than values. It reads the real thing only when the answer is yes.

An environment nobody touches is read once and then left alone, so your audit trail records secrets that moved rather than timers that fired.