How to sync secrets to Kubernetes without init containers
Hand-written Secret manifests and init-container scripts drift from the source of truth. The SnapEnv operator keeps native Kubernetes Secrets in sync from a single custom resource.
The problem
Teams usually end up with secrets in three places: a password manager, a CI variable, and a Kubernetes Secret someone applied by hand. When a value changes, all three have to be updated and the pods restarted.
Init containers that fetch secrets at startup add moving parts to every deployment and still do nothing when a value changes later.
How to do it with SnapEnv
Install the operator
One manifest installs the CRD, RBAC and the controller into the snapenv-operator namespace.
kubectl apply -f https://get.snapenv.io/operator/install.yaml
Store an access token as a Secret
Create a token in SnapEnv scoped to the project and environment, then store it in the cluster.
kubectl create secret generic snapenv-token \ --from-literal=token=snp_live_xxxxxxxxxxxx
Declare what to sync
A SnapEnvSecret resource names the project, the environment and the Kubernetes Secret to create.
apiVersion: snapenv.io/v1alpha1 kind: SnapEnvSecret metadata: name: api-prod spec: tokenSecret: snapenv-token project: <your-project-uuid> env: prod target: api-prod-env syncInterval: 30m
Mount it like any other Secret
Your Deployment reads the synced Secret with envFrom. The operator can also roll the linked Deployment when values change.
envFrom: - secretRef: name: api-prod-env
Frequently asked questions
Do I need init containers or a sidecar?
No. The operator writes a native Kubernetes Secret, so your pods consume it the normal way with envFrom or volume mounts.
Are workloads restarted when a secret changes?
The operator can restart the linked Deployment on change. See the Kubernetes integration docs for the auto-restart setting.
How often does it sync?
It polls on a fallback interval, 30 minutes by default, and uses conditional requests so it only does work when something changed.
Does it work with Helm?
Yes. The docs include a Helm chart integration for rendering SnapEnvSecret resources alongside your release.
Free for small teams. Set up in minutes.
3 projects, 3 members, full CLI and Kubernetes operator. No credit card.