{"id":13684360,"url":"https://github.com/shyiko/kubesec","last_synced_at":"2025-04-04T22:07:42.353Z","repository":{"id":23787528,"uuid":"99656992","full_name":"shyiko/kubesec","owner":"shyiko","description":"Secure Secret management for Kubernetes (with gpg, Google Cloud KMS and AWS KMS backends)","archived":false,"fork":false,"pushed_at":"2022-01-11T16:21:40.000Z","size":135,"stargazers_count":618,"open_issues_count":12,"forks_count":41,"subscribers_count":11,"default_branch":"master","last_synced_at":"2025-03-28T21:07:30.456Z","etag":null,"topics":["aws-kms","google-cloud-kms","gpg","kubernetes","secret"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/shyiko.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-08-08T06:14:42.000Z","updated_at":"2025-03-22T22:18:11.000Z","dependencies_parsed_at":"2022-07-27T04:17:18.046Z","dependency_job_id":null,"html_url":"https://github.com/shyiko/kubesec","commit_stats":null,"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shyiko%2Fkubesec","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shyiko%2Fkubesec/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shyiko%2Fkubesec/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shyiko%2Fkubesec/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/shyiko","download_url":"https://codeload.github.com/shyiko/kubesec/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247256112,"owners_count":20909240,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws-kms","google-cloud-kms","gpg","kubernetes","secret"],"created_at":"2024-08-02T14:00:32.620Z","updated_at":"2025-04-04T22:07:42.337Z","avatar_url":"https://github.com/shyiko.png","language":"Go","funding_links":[],"categories":["Secret generation and management","Go","Go (531)","文章"],"sub_categories":["[Jenkins](#jenkins)"],"readme":"# kubesec ![Latest Version](https://img.shields.io/badge/latest-0.9.2-blue.svg) [![Build Status](https://travis-ci.org/shyiko/kubesec.svg?branch=master)](https://travis-ci.org/shyiko/kubesec)\n\nSecure secret management for [Kubernetes](https://kubernetes.io/) (with [gpg](https://gnupg.org/), \n[Google Cloud KMS](https://cloud.google.com/kms/) and [AWS KMS](https://aws.amazon.com/kms/) backends).\n\n[![asciicast](https://asciinema.org/a/YCUk0q7e3qUi6kjqJq9NQdt6c.png)](https://asciinema.org/a/YCUk0q7e3qUi6kjqJq9NQdt6c)  \n  \nIn short, it allows you to encrypt [Secret](https://kubernetes.io/docs/concepts/configuration/secret/)s so that they can be stored in VCS along \nwith the rest of resources.  \nAn example of encrypted Secret is shown below (note that only the \"data\" is encrypted (and that keys are left untouched)): \n\n```yml\napiVersion: v1\nkind: Secret\nmetadata:\n  name: myapp-default-0\ntype: Opaque\ndata:\n  KEY: TUFkWD1iuKs=.O....D...=\n  ANOTHER_KEY: iOy1nf90+M6FrrEIoymN6cOSUYM=.E...=.q...=\n# ...  \n```\n\nThe nice thing about this approach (compared to complete file encryption) is that `git diff` and `git merge` become\nso much more user-friendly (+ you can ascertain that specific entry is present even if you don't have the key to decrypt the secret).\n\n`kubesec` is written in Go, works with (or without) [Yubikey](https://www.yubico.com/) ❤. \n\n\u003e For general-purpose secret management, take a look at [mozilla/sops](https://github.com/mozilla/sops)   \n(`kubesec`'s drawn a lot of inspiration from it). \n\n## Installation\n\n#### macOS\n\n```sh\ncurl -sSL https://github.com/shyiko/kubesec/releases/download/0.9.2/kubesec-0.9.2-darwin-amd64 \\\n  -o kubesec \u0026\u0026 chmod a+x kubesec \u0026\u0026 sudo mv kubesec /usr/local/bin/  \n``` \n\nVerify PGP signature (optional but recommended):\n\n```    \ncurl -sSL https://github.com/shyiko/kubesec/releases/download/0.9.2/kubesec-0.9.2-darwin-amd64.asc \\\n  -o kubesec.asc\ncurl -sS https://keybase.io/shyiko/pgp_keys.asc | gpg --import\ngpg --verify kubesec.asc /usr/local/bin/kubesec\n```  \n\n\u003e `gpg` can be installed with `brew install gnupg`\n\n##### ... with [Homebrew](https://brew.sh/)\n\n```\nbrew install shyiko/kubesec/kubesec\nbrew install shyiko/kubesec/kubesec --with-short-name # install as \"ksec\"\n```\n\n\u003e `brew install shyiko/kubesec/kubesec` is equivalent to `brew tap shyiko/kubesec \u0026\u0026 brew install kubesec`.\n\n#### Linux\n\n```sh\ncurl -sSL https://github.com/shyiko/kubesec/releases/download/0.9.2/kubesec-0.9.2-linux-amd64 \\\n  -o kubesec \u0026\u0026 chmod a+x kubesec \u0026\u0026 sudo mv kubesec /usr/local/bin/  \n``` \n\nVerify PGP signature (optional but recommended):\n\n```    \ncurl -sSL https://github.com/shyiko/kubesec/releases/download/0.9.2/kubesec-0.9.2-linux-amd64.asc \\\n  -o kubesec.asc\ncurl -sS https://keybase.io/shyiko/pgp_keys.asc | gpg --import\ngpg --verify kubesec.asc /usr/local/bin/kubesec\n```  \n\n#### Windows\n\nDownload executable from the [Releases](https://github.com/shyiko/kubesec/releases) page.\n\n## Usage\n\n\u003e **If you plan to use gpg**:  \n... but don't have a valid PGP key, see [GitHub Help - Generating a new GPG key](https://help.github.com/articles/generating-a-new-gpg-key/#platform-linux) on \nhow to generate one.  \n[gpg](https://gnupg.org/) (tested: 2.0+; recommended: 2.1+) must be available on the PATH.   \nIt's also highly recommended to set up [gpg-agent](https://wiki.archlinux.org/index.php/GnuPG#gpg-agent) to avoid \nconstant passphrase re-entry.    \n\n#### Encryption\n\n```sh\n# encrypt existing Secret (see `kubesec create` below on how to create encrypted secret from scratch)\nkubesec encrypt secret.yml\n# same as above but output is written back to secret.yml (instead of stdout)\nkubesec encrypt -i secret.yml\n\n# NOTE: if you don't specify --key - default PGP key will be used\n# in other words, `kubesec encrypt secret.yml` is identical to \nkubesec encrypt --key=pgp:default secret.yml\n\n# NOTE: multiple --key|s can be specified if needed \n# (and they don't have to be of the same type, i.e. `--key=pgp:... --key=arn:...` \n# is perfectly valid)\n\n# encrypt with PGP key (\"pgp:\" prefix is optional)\nkubesec encrypt --key=pgp:6206C32E111611688694CF5530BDA87E3E71C268 secret.yml\n\n# avoid gpgagent for pgp passprhase when encrypting with PGP key (\"pgp:\" prefix is optional)\nkubesec encrypt --passphrase=\u003csupersecret\u003e --key=pgp:6206C32E111611688694CF5530BDA87E3E71C268 secret.yml\n\n# encrypt with Google Cloud KMS key (\"gcp:\" prefix is optional)\n#\n# NOTE: you'll need either to `gcloud auth application-default login` or set\n# GOOGLE_APPLICATION_CREDENTIALS=/path/to/credentials.json \n# before attempting secret encryption/decryption\n#\n# https://developers.google.com/identity/protocols/application-default-credentials#howtheywork\nkubesec encrypt --key=gcp:\u003cresource-id of Google Cloud KMS key\u003e secret.yml\nkubesec encrypt \\ \n  --key=gcp:projects/project-0/locations/global/keyRings/keyring-0/cryptoKeys/key-0 secret.yml\n\n# encrypt with AWS KMS key (\"aws:\" prefix is optional)\n#\n# NOTE: you might need to `aws configure` (if you don't have ~/.aws/credentials already)\n#\n# http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html\nkubesec encrypt --key=aws:\u003cARN of AWS KMS key\u003e secret.yml\nkubesec encrypt \\\n  --key=aws:arn:aws:kms:us-west-1:000000000000:key/00000000-0000-0000-0000-000000000000 secret.yml\n\n# add ...D89 key \u0026 drop ...310 key (leave all other keys untouched)\nkubesec encrypt --key=+pgp:160A7A9CF46221A56B06AD64461A804F2609FD89 \\\n  --key=-pgp:6206C32E111611688694CF5530BDA87E3E71C268 secret.yml\n# NOTE: removal of a key will automatically result in data encryption key rotation\n# you will also need to change all the secrets as whoever you removed from the chain of trust might \n# still have access to the previous version of a file   \n\n# encrypt content of stdin\ncat secret.yml | kubesec encrypt -\n\n# create encrypted Secret from key=value pair(s) / file(s)\nkubesec create secret-name \\\n  --data key=value \\\n  --data file:pki/ca.crt \\\n  --data file:hostname.key=pki/private/server.key \\\n  -o secret.enc.yml\n```\n\n#### Decryption\n\n```sh\n# decrypt a Secret \n# (usually combined with kubectl (`kubesec decrypt secret.enc.yml | kubectl apply -f -`))\nkubesec decrypt secret.enc.yml \n\n# decrypt without invoking gpgagent - useful for unattended interaction or for alternate keyrings \n#\n# You can prevent these lines ending up in history with a space \n# see https://www.linuxjournal.com/content/using-bash-history-more-efficiently-histcontrol or https://superuser.com/questions/352788/how-to-prevent-a-command-in-the-zshell-from-being-saved-into-history \nkubesec decrypt --keyring alternate.keyring --passphrase=\u003csupersecret\u003e secret.yml\n\n# decrypt to a custom Go Template (http://golang.org/pkg/text/template) string\nkubesec decrypt secret.enc.yml --cleartext --template='KEY={{ .data.KEY }}'\nkubesec decrypt secret.enc.yml --cleartext \\\n  --template=$'{{ range $k, $v := .data }}{{ $k }}={{ $v }}\\n{{ end }}' \u003e .env\n```\n\n#### Modification\n\n```sh\n# open decrypted Secret in $EDITOR (it will be automatically re-encrypted upon save)\nkubesec edit -i secret.enc.yml\nkubesec edit -i --key=\u003ca-different-key-to-re-encrypt-with\u003e secret.enc.yml\n# same as above but secret.enc.yml will be created if it doesn't exist \nkubesec edit -if secret.enc.yml\n\n# batch editing (noninteractive)\nkubesec patch -i secret.enc.yml --data key1=secret_string --data file:key2=path/to/file\n\n# \"decrypt, modify-in-any-way-you-like, re-encrypt\" \nkubesec decrypt --cleartext secret.enc.yml -o secret.yml\n# edit secret.yml using your favourite editor / tool\nkubesec encrypt --cleartext secret.yml -o secret.enc.yml --parent=secret.enc.yml\n# --parent=path/to/encrypted/secret.enc.yml above is used to preserve keys, DEK and IVs (when safe)\n```\n\n#### Introspection\n\n```sh\n# show information about the Secret (who has access to the \"data\", last modification date, etc)\nkubesec introspect secret.enc.yml\n```\n\n#### \u003ckbd\u003eTab\u003c/kbd\u003e completion\n\n```sh\n# bash\nsource \u003c(kubesec completion bash)\n\n# zsh\nsource \u003c(kubesec completion zsh)\n```\n\n\u003e `-` can be used anywhere (where a file is expected) to reference `stdin`.  \n\u003e (for more information see `kubesec --help`)\n\n## Example(s)\n\n#### #1 (basic)\n\n```sh\nkubesec create secret-name -d key=value -d file:path/to/file -o secret.enc.yml  \nkubesec decrypt secret.enc.yml | kubectl apply -f -\n```\n\n## Playground\n\nIf you have `docker` installed you don't need to download `kubesec` binary just to try it out.  \nInstead, launch a container and start playing: \n\n```sh\ndocker run -it --rm shyiko/kubesec-playground:0.9.2 /bin/bash\n$ kubesec encrypt secret.yml\n```\n\n\u003e `shyiko/kubesec-playground` image contains `gpg` 2.1+, kubesec, vim (as a default $EDITOR) and \n  secret PGP key of Jean-Luc Picard (PGP fingerprint - 6206C32E111611688694CF5530BDA87E3E71C268). \n\n\u003e Dockerfile [is included within this repo](kubesec-playground.dockerfile).\n\n## Encryption Protocol\n\n- \"data\" values are encrypted with AES-GCM \n(each value is padded to a block-size (48 bytes by default) and then encrypted using a shared (resource-unique, randomly generated) 256-bit DEK \u0026 a 96-bit random IV).\n- DEK is encrypted (and signed in case of PGP) with `--key`(s) before being stored in a Secret as `# kubesec:\u003ckey type\u003e:\u003ckey id\u003e:...` (one entry for each `--key`).\n\nIn addition to the above, kubesec also generates MAC (AES-GMAC, with AAD constructed from both the \"data\" and the `--key`(s)). If MAC is missing or invalid - \ndecryption will fail (`kubesec edit -i --recompute-mac \u003cfile\u003e` can be used to recompute MAC when necessary (e.g. after `git merge`)).  \n\n## Reporting Security Issues\n\nPlease reach me at https://keybase.io/shyiko. \n\n## Development\n\n\u003e PREREQUISITE: [go1.9](https://golang.org/dl/)+.\n\n```sh\ngit clone https://github.com/shyiko/kubesec $GOPATH/src/github.com/shyiko/kubesec \ncd $GOPATH/src/github.com/shyiko/kubesec\nmake fetch\n\ngo run kubesec.go\n```\n\n## Legal\n\nAll code, unless specified otherwise, is licensed under the [Apache-2.0](LICENSE) license.  \nCopyright (c) 2018 Stanley Shyiko.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshyiko%2Fkubesec","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fshyiko%2Fkubesec","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshyiko%2Fkubesec/lists"}