{"id":46282115,"url":"https://github.com/jossware/kustomize-gopass","last_synced_at":"2026-03-04T06:03:34.262Z","repository":{"id":262086195,"uuid":"886036431","full_name":"jossware/kustomize-gopass","owner":"jossware","description":"A Kustomize generator for injecting secrets from gopass.","archived":false,"fork":false,"pushed_at":"2025-11-30T17:35:54.000Z","size":44,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-12-03T01:30:02.628Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jossware.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-11-10T02:40:12.000Z","updated_at":"2025-11-30T17:25:56.000Z","dependencies_parsed_at":null,"dependency_job_id":"6a27c164-8e71-4398-a360-50693b297485","html_url":"https://github.com/jossware/kustomize-gopass","commit_stats":null,"previous_names":["jossware/kustomize-gopass"],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/jossware/kustomize-gopass","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jossware%2Fkustomize-gopass","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jossware%2Fkustomize-gopass/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jossware%2Fkustomize-gopass/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jossware%2Fkustomize-gopass/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jossware","download_url":"https://codeload.github.com/jossware/kustomize-gopass/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jossware%2Fkustomize-gopass/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30073704,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-04T05:31:57.858Z","status":"ssl_error","status_checked_at":"2026-03-04T05:31:38.462Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-03-04T06:03:33.588Z","updated_at":"2026-03-04T06:03:34.257Z","avatar_url":"https://github.com/jossware.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"![release](https://github.com/jossware/kustomize-gopass/actions/workflows/release.yml/badge.svg)\n\n# kustomize-gopass\n\nkustomize-gopass is an [exec-based KRM function](https://kubectl.docs.kubernetes.io/guides/extending_kustomize/exec_krm_functions/) [Kustomize plugin](https://kubectl.docs.kubernetes.io/guides/extending_kustomize/) that injects secrets from [gopass](https://www.gopass.pw/) into Kubernetes `Secret` resources. This allows you to work with Kubernetes Secret resources in your Kustomize base without directly including the sensitive secret values in your manifests.\n\nHere's how it works:\n\nIn your Kustomize base, you can include your `Secret` resources, but instead of embedding the actual secret values, you set the secret keys to point to the paths of the secrets stored in your pre-configured gopass password manager. When you run `kustomize build`, the kustomize-gopass plugin executes. It reads any gopass paths specified in the secret keys and retrieves the corresponding secret values from your gopass repository. The plugin then injects the retrieved secret values into the `Secret` resource(s) rendered by Kustomize.\n\nThis approach allows you to manage your sensitive data in gopass, while still maintaining the convenience of defining your Kubernetes resources in Kustomize.\n\n## Table of Contents\n\n- [kustomize-gopass](#kustomize-gopass)\n    - [Table of Contents](#table-of-contents)\n    - [Installation](#installation)\n        - [Download pre-compiled binary](#download-pre-compiled-binary)\n        - [go install](#go-install)\n    - [Usage](#usage)\n        - [Example](#example)\n    - [When to use this?](#when-to-use-this)\n    - [Development](#development)\n    - [Running Tests](#running-tests)\n    - [Contributing](#contributing)\n    - [License](#license)\n\n## Installation\n\n### Download pre-compiled binary\n\nkustomize-gopass is available on Linux, Mac, and Windows \u003csup\u003e1\u003c/sup\u003e.\n\n1. Visit the [releases](https://github.com/jossware/kustomize-gopass/releases) page of this repository.\n2. Download the appropriate archive for your operating system and architecture.\n3. Extract the archive\n4. Move the binary to a location in your PATH\n\n### go install\n\n```sh\ngo install github.com/jossware/kustomize-gopass@latest\n```\n\n## Usage\n\nIf you want to include a `Secret` in a Kustomize base that retrieves values from gopass, you need to:\n\n1. Annotate it with the `config.kubernetes.io/function` to tell Kustomize what function to run.\n\n    ``` yaml\n    metadata:\n      annotations:\n        config.kubernetes.io/function: |\n          exec:\n            path: kustomize-gopass\n    ```\n\nThe above assumes that the `kustomize-gopass` binary is in your `PATH`. If not, you can modify the above to the absolute path to the `kustomize-gopass` binary on your system.\n\n2. Configure any `data` or `stringData` fields to use values stored in gopass. You do this by setting the field to a value like `gopass:\u003cpath/to/secret/in/gopass\u003e`. For example:\n\n    ``` yaml\n    data:\n      password: gopass:dev/db/password\n    ```\n\nNext, you need to configure Kustomize to treat the manifest for the `Secret` above as a [generator](https://kubectl.docs.kubernetes.io/guides/extending_kustomize/#specification-in-kustomizationyaml).\n\n``` yaml\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\ngenerators:\n  - my-secrets.yaml\n# ...\n```\n\n3. Build\n\nIn order to run Kustomize with function support, you need to use the `--enable-alpha-plugins` and `--enable-exec` flags.\n\n``` shell\nkustomize build --enable-exec --enable-alpha-plugins my-base\n```\n\n### Example\n\nmy-secret.yaml\n\n``` yaml\napiVersion: v1\nkind: Secret\ntype: Opaque\nmetadata:\n  name: my-secrets\n  annotations:\n    config.kubernetes.io/function: |\n      exec:\n        path: kustomize-gopass\ndata:\n  dbpw: gopass:dev/db/password\n  apikey: gopass:dev/thirdparty/app/apikey\n```\n\nkustomization.yaml\n\n``` yaml\napiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\ngenerators:\n  - my-secrets.yaml\n# ...\n```\n\n``` shell\n$ kustomize build --enable-exec --enable-alpha-plugins .\n---\napiVersion: v1\nkind: Secret\ntype: Opaque\nmetadata:\n  name: my-secrets\ndata:\n  dbpw: \u003cactual base64-encoded secret value\u003e\n  apikey: \u003cactual base64-encoded secret value\u003e\n...\n```\n\n## When to use this?\n\nWe built kustomize-gopass for existing gopass users who want to more easily manage Kubernetes secrets for local development, side projects, or in homelab scenarios. Keep in mind that generating Kubernetes secrets client-side does make it rather easy for plain text secrets to leak into your terminal output, CI/CD logs, or elsewhere. For production, business-critical systems, we would lean towards something like the [Secrets Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/) or [External Secrets Operator](https://external-secrets.io/latest/) or any of the varied secrets-management solutions available in the Kubernetes ecosystem. \n\n## Development\n\nTo build and run the project locally, clone the repository and run:\n\n```sh\ngit clone https://github.com/yourusername/kustomize-gopass.git\ncd kustomize-gopass\ngo build\n./kustomize-gopass\n```\n\n## Running Tests\n\nTo run tests, use the following command:\n\n```sh\ngo test ./...\n```\n\n## Contributing\n\nContributions are welcome! Please open an issue or submit a pull request.\n\n## License\n\nThis project is licensed under the MIT License. See the LICENSE file for details.\n\n---\n\n\u003csup\u003e1\u003c/sup\u003e _note_: kustomize-gopass has not been tested extensively on Windows. Please file an issue if you run into any problems.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjossware%2Fkustomize-gopass","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjossware%2Fkustomize-gopass","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjossware%2Fkustomize-gopass/lists"}