Important
Regarding the code, most of the SOPS implementation was taken from the Flux kustomize-constroller project. We have left the License-Header as-is, if further attribution is wished, please open an issue. We go the idea from the existing sops-operator. However the implementation was not optimal for our use-cases, that's why we decided to release our own solution.
We have always loved how Flux handles Secrets with SOPS, it's such a seamless experience. However we have noticed, that it's kind of hard to actually distribute keys to users in a kubernetes native way. That's why we built this operator. It introduces Providers, which essentially match Kubernetes resources which represent Keys or access to KMS stores. On the Provides you also declare, which Secrets you want to encrypt with that provider. Currently only works with PGP and AGE for n-secrets That leaves open that, N-providers can load private keys for one Secret, in complex scenarios. Also we want to provide a general solution to decrypting secrets, not a solution which is dependent on a gitops engine.
This Operators introduces the concept of SopsProviders. SopsProviders are created by Cluster-Administrators and are essentially a connecting-piece for collecting private-keys and SopsSecrets, which can use these keys for decryption.
With this option an Kubernetes users may manage their own keys and SopsSecrets. The implementation of SopsSecrets allows them to be applied to the Kubernetes API with sops encryption-meta. The entire decryption happens within the cluster. So a SopsSecret is applied the way it's stored eg. in git.
Read the documentation for installation, usage, monitoring, and the API reference. The source is in docs/content/docs.
Use the locked toolchain and tasks shared by local development and CI:
devbox shell
task hooks:install
task --list
task test
task docs:serveSee the development guide for the Kind environment, chart tasks, and documentation checks.
Spin up a live demonstration of the addon on Killercoda:
This addon is developed by the community. For enterprise support (production ready setup,tailor-made features) reach out to Peak Scale
Copyright 2024.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
