Just a `bw` command in container
540
Minimal Debian-based Docker container with the Bitwarden CLI (bw).
Designed for integration with external-secrets-operator to securely fetch secrets from Bitwarden (Vaultwarden) into Kubernetes.
| Variable | Description |
|---|---|
BW_HOST | Bitwarden server URL (e.g. https://vw.example.com) |
BW_USER | Bitwarden username (email address) |
BW_PASSWORD | Bitwarden user password |
The container runs bw serve --hostname 0.0.0.0 listening on port 8087.
Restrict access to bitwarden-cli only from external-secrets pods:
---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: external-secret-to-bw-cli
spec:
podSelector:
matchLabels:
app.kubernetes.io/instance: bitwarden-cli
app.kubernetes.io/name: bitwarden-cli
ingress:
- from:
- podSelector:
matchLabels:
app.kubernetes.io/instance: external-secrets
app.kubernetes.io/name: external-secrets
Define a ClusterSecretStore that points to your Bitwarden CLI webhook:
---
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
name: bitwarden-store
spec:
provider:
webhook:
url: "http://bitwarden-cli:8087/object/item/{{ .remoteRef.key }}"
headers:
Content-Type: application/json
result:
jsonPath: "$.data.{{ .remoteRef.property }}"
Then, create an ExternalSecret referencing a Bitwarden item:
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: example-secret
spec:
target:
name: my-k8s-secret
deletionPolicy: Delete
template:
type: Opaque
data:
# The key stored in resulting Kubernetes Secret
apiKey: |-
{{ .apiKey }}
data:
- secretKey: apiKey
sourceRef:
storeRef:
name: bitwarden-store
kind: ClusterSecretStore
remoteRef:
key: <bitwarden-item-id> # e.g., "1234abcd-5678-efgh-9012-ijklmnopqrst"
property: fields[0].value # field to fetch from Bitwarden item
Content type
Image
Digest
sha256:708834758…
Size
96.9 MB
Last updated
8 months ago
docker pull ultradesu/bitwarden-client:2025.12.1