OpenShift secrets have by-design problems that will leave your secrets exposed because it’s just encoded using base64 and are not encrypted. In order to solve this issue, Akeyles enables containerized applications to leverage static and dynamic secrets sourced from Akeyless. This plugin leverages a webhook to intercept and augment specifically annotated pod configuration for secrets injection using a sidecar container. Applications need only concern themselves with finding a secret at a filesystem path, rather than managing tokens, connecting to an external API, or other mechanisms for direct interaction with secrets management systems. Sidecar containers fetch secrets before an application starts, i.e. to be used by a web application that is using dynamic secrets to connect to a database with an expiring lease.