RustJack

Ultimate Certificate Authority Injector for Kubernetes Pods 💉

Rust Kubernetes Docker Helm
A blazing fast, zero-allocation, stateless, and cloud-native event-driven Mutating Admission Webhook for CA Injection in Kubernetes.

RustJack allows off-the-shelf deployments to run in enterprise or air-gapped clusters with custom Certificate Authorities (CAs) without modifying container images. Say goodbye to the manual, repetitive process of ADD yourca.crt ... and RUN update-ca-certificates in your Dockerfiles.

🎯 The Pain of Custom CAs (Why You Need RustJack)

If you work in an enterprise, air-gapped, or highly regulated environment, you already know the nightmare of Deep Packet Inspection (DPI), SSL interception, and custom root authorities. Before RustJack, SRE/Platform/DevOps Engineers had to choose their poison:

RustJack is the ultimate cure. It decouples the certificate trust layer from your application layer cleanly, instantly, and with zero operational overhead.

🏛️ The RustJack Philosophy

RustJack is not just another Kubernetes webhook, it is an architectural statement. Built with extreme Site Reliability Engineering (SRE) principles:

✨ How It Works

When a Pod with the rustjack.io/inject: "true" label is submitted, RustJack intercepts the request and instantly injects the required CA trust chain before the Pod is scheduled:

  1. Injects a Secret Volume: Mounts your custom CA bundle into all containers (including initContainers).
  2. Exports Environment Variables: Automatically configures standard trust paths (SSL_CERT_FILE, REQUESTS_CA_BUNDLE, NODE_EXTRA_CA_CERTS, etc.) pointing to the injected CA file.

Your applications instantly trust the corporate CA—zero code changes required.

🚀 Installation (Helm)

This page serves as the official Helm chart repository. Install RustJack directly into your cluster:

helm repo add rustjack https://omidiyanto.github.io/rustjack/
helm repo update

helm upgrade --install rustjack-cainjector rustjack/rustjack-cainjector \
  --namespace cert-manager \
  --create-namespace \
  --wait

🔗 Enterprise Ecosystem: CA Distribution (Optional)

Architectural Note: RustJack is 100% independent. If you manually create a standard Kubernetes Opaque Secret containing your ca.crt, RustJack will happily inject it. However, for true enterprise automation across dozens of namespaces, we highly recommend pairing RustJack with trust-manager.

1. Install the cert-manager & trust-manager stack:

helm repo add jetstack https://charts.jetstack.io --force-update

helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace --set crds.enabled=true

helm upgrade trust-manager jetstack/trust-manager \
  --install --namespace cert-manager --wait \
  --set secretTargets.enabled=true --set secretTargets.authorizedSecretsAll=true

2. Define your corporate CA once using a Bundle:

apiVersion: trust.cert-manager.io/v1alpha1
kind: Bundle
metadata:
  name: my-root-ca # This name will be referenced in your pod's annotation
spec:
  sources:
    - useDefaultCAs: true
    - inLine: |
        -----BEGIN CERTIFICATE-----
        MIIDNTC..................
        -----END CERTIFICATE-----
  target:
    secret:
      key: "ca.crt"

trust-manager replicates this CA into every namespace, and RustJack natively mounts these replicated Secrets into your Pods.

💡 Usage Guide (Strict Mode)

RustJack operates in Strict Mode. You MUST provide both the specific trigger label and the configuration annotation to prevent unnecessary webhook invocations.

Scope Key Description
Label rustjack.io/inject: "true" [REQUIRED] Instructs the Kube-apiserver to route this Pod to the webhook.
Annotation rustjack.io/ca-secret [REQUIRED] The exact name of the Kubernetes Secret containing your ca.crt.
Annotation rustjack.io/mount-path [Optional] Directory where the CA will be mounted. Default: /ssl.
Annotation rustjack.io/extra-envs [Optional] Comma-separated list of additional env vars to inject.

Example: Zero-Touch Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-secure-app
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-secure-app
  template:
    metadata:
      labels:
        app: my-secure-app
        # 👇 1. THE TRIGGER LABEL 👇
        rustjack.io/inject: "true"
      annotations:
        # 👇 2. DEFINE CA SECRET NAME TO BE INJECTED 👇
        rustjack.io/ca-secret: "my-root-ca"
    spec:
      containers:
      - name: main-app
        image: alpine:latest
        command: ["sleep", "infinity"]

Verification

# Check the RustJack logs
kubectl logs -l app.kubernetes.io/name=rustjack-cainjector -n cert-manager

# Verify the application Pod
kubectl exec -it deploy/my-secure-app -- env | grep "SSL\|CUSTOM"
kubectl exec -it deploy/my-secure-app -- ls -la /ssl/ca.crt

📊 Performance Benchmarks

Tested on a production RKE2 cluster with 30 concurrent Pod scaling operations: