https://github.com/jmhodges/kustomize-age

A kustomize plugin for using age encrypted files in Secrets
https://github.com/jmhodges/kustomize-age

Last synced: 4 months ago
JSON representation

A kustomize plugin for using age encrypted files in Secrets

• Host: GitHub
• URL: https://github.com/jmhodges/kustomize-age
• Owner: jmhodges
• License: apache-2.0
• Created: 2020-09-11T10:33:14.000Z (almost 4 years ago)
• Default Branch: main
• Last Pushed: 2023-12-19T09:28:25.000Z (6 months ago)
• Last Synced: 2024-01-23T05:14:25.245Z (5 months ago)
• Language: Go
• Size: 205 KB
• Stars: 12
• Watchers: 3
• Forks: 1
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Lists

• awesome-age - kustomize-age

README

        
kustomize-age is a plugin for `kustomize` that allows the user to keep local

files encrypted with `age` that are decrypted before being used as `files`

inside a kubernetes `Secret`.

Unlike kustomize-sops it does not encrypt the whole `Secret` yaml file, but just

the files mentioned in the `Secret`'s `files` attribute.

Use

===

First, run `make install` and it will build this as a Go plugin and install it

into your `$XDG_CONFIG_HOME`. (The Makefile is small, so you can read it to see

exactly what it's doing.)

Then, you'll create your `Secret` yaml file normally but with a few changes:

* `apiVersion` should be set to `apiVersion: kustomize-age/v1`

* `kind` should be set to `OndiskEncryptedSecret` instead of `Secret` (though,

  the final object that's added to your k8s cluster will be a `Secret`).

* `files` should be the file paths you want decrypted and stored in the `Secret`

  without the `.age` suffix on them. For example, a `mycredentials.key` in

  `files` of the `OndiskEncryptedSecret` will correspond to the age encrypted

  file on disk at `mycredentials.key.age`)

Those `.age` file paths will be the file paths you wanted included in the

`Secret` but encrypted with the `age` key specified.

By default, the `age` key used to decrypt these files is expected to be in the

`KUBE_AGE_KEY` environment variable. The environment variable used can be

overrided by setting the `ageKeyEnvVar` in the `OndiskEncryptedSecret`.

Example

=======

Supposing you have a file path you want in your secret at

`mycredentials.key.age`

```

$ ls

mycredentials.key.age mycredentials.yaml

$ cat mycredentials.yaml

apiVersion: kustomize-age/v1

kind: OndiskEncryptedSecret

metadata:

    name: some-svc-credentials

files:

    - mycredentials.key

# likely, you'll want to delete this next line and use the

# default KUBE_AGE_KEY env var.

ageKeyEnvVar: ANOTHER_ENV_VAR

```

Caveat

======

As with many Go plugins, you may have to fork this repo and adjust its `go.mod`

in order to correct package mismatches with your `kustomize` binary.