Skip to content

Secrets

Almost all services require some kind of secret value at runtime. In order to store those secrets safely inside the Git repository I use Mozilla SOPS which is natively supported by Flux – more precisely, I use age as an algorithm for encryption.

Info

Please keep in mind that this page is only meant as an example implementation of my workflow. You're free to adapt it, but you will need to adjust it by yourself.

Prerequisites

It is required to have SOPS and age installed on your machine. You can leverage brew for that:

$ brew install sops age

You also need to generate a key for age and enable the Flux controllers to decrypt your secrets.

Store age key in environment variable

This repository provides some task definitions to easily maintain SOPS encrypted files. To use them you just need to ensure your age public key is available in an environment variable called AGE_PUBLIC_KEY.

Workflow

Let's assume you want to deploy an application which needs the following secret to connect to a database:

db-user.sops.yaml
1
2
3
4
5
6
7
8
9
apiVersion: v1
kind: Secret
metadata:
  name: postgresql-user
  namespace: my-app
type: kubernetes.io/basic-auth
stringData:
  username: my-app
  password: $uper$ecret123

To store the secret safely in the Git repository, you would do the following:

  1. You create the secret manifest locally and name it e.g. db-user.sops.yaml
  2. Encrypt the file using SOPS & age
  3. Specify the secret inside the Deployment as you normally would
  4. Commit the files to the Git repository

As soon as the commit is pushed to the Git repository, the following happens inside the cluster:

  1. source-controller pulls the changes from Git
  2. kustomize-controller loads the age keys from the sops-age secret
  3. kustomize-controller decrypts your secret and applies it on the cluster

Commands

Encryption

The following commands allow you to encrypt any YAML or JSON file and store it inside the Git repository:

$ task sops:encrypt:secret -- path/to/my/secret.sops.yaml

$ task sops:encrypt:generic -- path/to/my/secret.sops.yaml

Decryption

If you need to modify the secret value later on, you can decrypt it locally – as long as the private age key exists on your machine:

$ task sops:decrypt:secret -- path/to/my/secret.sops.yaml

$ task sops:decrypt:generic -- path/to/my/secret.sops.yaml