Skip to content

Commit

Permalink
Various documentation improvements
Browse files Browse the repository at this point in the history
  • Loading branch information
jcassee committed Aug 4, 2020
1 parent d788209 commit fc76775
Showing 1 changed file with 7 additions and 4 deletions.
11 changes: 7 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,11 @@ SecretGenerator ❤ sops

## Why use this?

[Kustomize](https://github.com/kubernetes-sigs/kustomize) is a great tool to implement a [GitOps](https://www.weave.works/blog/gitops-operations-by-pull-request) workflow with. When a Git repository is the single source of truth it often contains sensitive data that needs to be encrypted at rest. Mozilla's [sops](https://github.com/mozilla/sops) is a simple and flexible tool for managing secrets that is very suitable for that task.
[Kustomize](https://github.com/kubernetes-sigs/kustomize) is a great tool for implementing a [GitOps](https://www.weave.works/blog/gitops-operations-by-pull-request) workflow. When a repository describes the entire system state, it often contains secrets that needs to be encrypted at rest. Mozilla's [sops](https://github.com/mozilla/sops) is a simple and flexible tool that is very suitable for that task.

This Kustomize plugin allows you to transparently create Secrets from sops-encrypted files during resource generation. It is explicitly modeled after the builtin [SecretGenerator](https://github.com/kubernetes-sigs/kustomize/blob/master/docs/plugins/builtins.md#secretgenerator) plugin. Because it is an exec plugin, it is not tied to the specific compilation of Kustomize, [like Go plugins are](https://github.com/kubernetes-sigs/kustomize/blob/master/docs/plugins/goPluginCaveats.md).


### Alternatives

There are a number of other plugins that can serve the same function:
Expand All @@ -24,7 +25,7 @@ There are a number of other plugins that can serve the same function:
* [barlik/kustomize-sops](https://github.com/barlik/kustomize-sops)
* [sopsencodedsecrets](https://github.com/monopole/sopsencodedsecrets)

Most of these projects are in constant development. I invite you to pick the project that best fits your goals.
Most of these projects are in constant development. I invite you to check them out and pick the project that best fits your goals.

Credit goes to [Seth Pollack](https://github.com/sethpollack) for the [Kustomize Secret Generator Plugins KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-cli/kustomize-secret-generator-plugins.md) and subsequent implementation that made this possible.

Expand Down Expand Up @@ -87,7 +88,7 @@ The output is a Kubernetes secret containing the decrypted data:
metadata:
name: my-secret-hkkmtf8hkh

Like SecretGenerator, SopsSecretGenerator supports the [generatorOptions](https://github.com/kubernetes-sigs/kustomize/blob/master/docs/fields.md#generatoroptions) fields. Data key-values ("envs") can be read from dotenv, YAML and JSON files. If the data is a file and the Secret data key is different from the filename, you can use `key=file`.
Like SecretGenerator, SopsSecretGenerator supports the [generatorOptions](https://github.com/kubernetes-sigs/kustomize/blob/master/docs/fields.md#generatoroptions) fields. Data key-values ("envs") can be read from dotenv, YAML and JSON files. If the data is a file and the Secret data key needs to be different from the filename, you can use `key=file`.

An example showing all options:

Expand All @@ -110,13 +111,15 @@ An example showing all options:
- secret-file2.txt=secret-file2.sops.txt
type: Oblique


## Using SopsSecretsGenerator with ArgoCD

SopsSecretGenerator can be added to ArgoCD by [patching](./docs/argocd.md) an initContainer into the ArgoCD provided `install.yaml`.


## Development

You will need [Go](https://golang.org) 1.12 or higher to develop and build the plugin.
You will need [Go](https://golang.org) 1.13 or higher to develop and build the plugin.


### Test
Expand Down

0 comments on commit fc76775

Please sign in to comment.