CyberArk Conjur Enterprise Guide for Secrets Management in Kubernetes and CI/CD

Overview

CyberArk Conjur is a machine identity and secrets management platform used to centralize, secure, and audit access to passwords, API keys, certificates, and database credentials for applications and automation. Enterprises adopt it to remove hardcoded secrets from code and pipelines, enforce least privilege, and integrate secrets delivery with Kubernetes, OpenShift, and modern DevSecOps workflows.

Conjur is commonly deployed where security teams need policy-driven access control, strong auditability, and integration with broader CyberArk privileged access management capabilities. It supports both static secrets and dynamic retrieval patterns, helping organizations reduce credential sprawl and improve compliance posture.

Architecture

Core components include:

• Conjur Server: policy engine, secret store, authentication, and audit services.
• Conjur Followers: read-only replicas placed close to workloads for scale and low-latency secret retrieval.
• Conjur Clients: CLI, SDKs, sidecars, and Kubernetes integrations.
• Authenticators: identity verification for Kubernetes, JWT/OIDC, LDAP, and cloud-native identities.

Deployment models:

• Self-hosted on VMs or Kubernetes for full operational control.
• Enterprise HA with leader-standby and followers across zones.
• Hybrid where Conjur integrates with CyberArk Vault for privileged credential rotation.

Typical data flow:

1. A workload authenticates using authn-k8s, JWT, or host identity.
2. Conjur validates identity against policy.
3. The workload requests an authorized variable such as db/password.
4. Conjur returns the secret over TLS and records the event in audit logs.

Implementation Guide

1. Install CLI and log in

curl -L https://github.com/cyberark/conjur-api-go/releases/download/v0.13.0/conjur-linux-amd64 -o /usr/local/bin/conjur
chmod +x /usr/local/bin/conjur
export CONJUR_APPLIANCE_URL=https://conjur.example.com
export CONJUR_ACCOUNT=prod
conjur init -u $CONJUR_APPLIANCE_URL -a $CONJUR_ACCOUNT
conjur authn login -u admin -p 'SuperSecretAdminPassword'

2. Define policy

Create policy.yml:

- !policy
  id: apps
  body:
    - !group developers
    - !host api-service
    - !variable db/username
    - !variable db/password
    - !permit
      role: !host api-service
      privileges: [ read, execute ]
      resource: !variable db/password
    - !permit
      role: !group developers
      privileges: [ read, execute ]
      resource: !variable db/username

Load it:

conjur policy load root policy.yml
conjur variable values add apps/db/username appuser
conjur variable values add apps/db/password 'Str0ngP@ssw0rd!'

3. Configure Kubernetes authenticator

kubectl create namespace conjur-app
kubectl create serviceaccount api-service -n conjur-app
kubectl annotate serviceaccount api-service -n conjur-app authenticator=authn-k8s/prod

Create conjur-connection.yaml:

apiVersion: v1
kind: ConfigMap
metadata:
  name: conjur-connect
  namespace: conjur-app
data:
  CONJUR_ACCOUNT: prod
  CONJUR_APPLIANCE_URL: https://conjur.example.com
  CONJUR_AUTHN_URL: https://conjur.example.com/authn-k8s/prod

4. Deploy a workload with secret injection

kubectl apply -f conjur-connection.yaml
kubectl apply -f app-secrets.yaml

Code Examples

Example 1: Bash secret retrieval

export CONJUR_AUTHN_LOGIN=host/apps/api-service
export CONJUR_AUTHN_API_KEY=$(cat /etc/conjur/host-api-key)
conjur authn login
conjur variable value apps/db/password

Example 2: Kubernetes secret mapping

apiVersion: v1
kind: Pod
metadata:
  name: api-service
  namespace: conjur-app
  annotations:
    conjur.org/container-mode: sidecar
spec:
  serviceAccountName: api-service
  containers:
    - name: app
      image: nginx:1.27
      env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: app-db-secret
              key: password

Example 3: Python SDK usage

from conjur import Conjur
client = Conjur(appliance_url="https://conjur.example.com", account="prod", login="host/apps/api-service", api_key="HOST_API_KEY")
client.authenticate()
db_password = client.get("apps/db/password")
print(db_password)

Security Hardening

• Enforce TLS 1.2+ with enterprise CA-signed certificates and certificate pinning where supported.
• Store Conjur master keys in an HSM or managed KMS-backed secure process.
• Use followers for workload reads and restrict direct access to leaders.
• Apply least privilege in policy: grant read only to exact variables, not broad policy branches.
• Rotate host API keys and upstream credentials regularly through CyberArk Vault integrations.
• Enable centralized log forwarding to SIEM and monitor repeated authentication failed events.
• Segment Conjur nodes in dedicated management subnets and restrict ingress with firewall rules.

Comparison

Troubleshooting

Error 1: Kubernetes authentication failure

Log sample:

2024-11-18T10:14:22Z conjur[2145]: authenticator ERROR: Authentication Error: CAKC029E Authentication of host 'host/conjur-app/api-service' failed

Fix:

• Verify service account mapping in policy.
• Confirm CONJUR_AUTHN_URL matches the configured authenticator ID.
• Check Kubernetes API CA bundle and token reviewer permissions.

Error 2: Variable not found

Log sample:

2024-11-18T10:16:04Z conjur[2145]: rails ERROR: RecordNotFound: Variable apps/db/password not found in account prod

Fix:

• Confirm the policy path is correct.
• Run conjur list to verify resource IDs.
• Reload policy if the variable was added to a different branch.

Error 3: TLS trust failure

Log sample:

curl: (60) SSL certificate problem: unable to get local issuer certificate

Fix:

• Install the issuing CA into the client trust store.
• Validate full certificate chain on the Conjur endpoint.
• Ensure hostname in certificate matches conjur.example.com.

Best Practices

Do

• Use separate policy branches for dev, test, and prod.
• Authenticate workloads with Kubernetes or JWT identities instead of shared API keys.
• Place followers near clusters to reduce latency and isolate failure domains.
• Audit secret access patterns and alert on unusual read volume.

Don't

• Do not store Conjur admin credentials in CI variables without rotation.
• Do not grant a group access to !policy apps when only one variable is needed.
• Do not expose Conjur leader nodes directly to application namespaces.
• Do not embed secrets in Helm values files; reference Conjur-injected values instead.