a06003c004
* Align treasuremap virtual-airship-core site to recent changes of airshipctl * This PS takes care of only the "airship-core" type and all other sites will fail validate docs untill the secrets are aligned. * So the validate_docs is invoked with parameter "virtual-airship-core" to run document validation just for virtual-airship-core reference airshipctl commit: e2c56108eef38dd83df52fcfd1fa6844e5376a56 Change-Id: I2e6149951beca570a3cadeecbc05366325c80286 |
||
|---|---|---|
| .. | ||
| results | ||
| README.md | ||
README.md
Secrets generator/encrypter/decrypter
This directory contains an utility that helps generate, encrypt and decrypt secrects. These secrects can be used anywhere in manifests.
For example we can use PGP key from SOPS example.
To get the key we need to run:
curl -fsSL -o key.asc https://raw.githubusercontent.com/mozilla/sops/master/pgp/sops_functional_tests_key.asc
and import this key as environment variable:
export SOPS_IMPORT_PGP="$(cat key.asc)" && export SOPS_PGP_FP="FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4"
Generator
To generate secrets we use template that will be passed
to kustomize as generators during airshipctl phase run secret-generate
execution.
Encrypter
To encrypt the secrets that have been generated we use generic container executor.
To start the secrets generate phase we need to execute following phase:
airshipctl phase run secret-generate
The executor run SOPS container and pass the pre-generated secrets to this container.
This container encrypt the secrets and write it to directory specified in kustomizeSinkOutputDir(results/generated).
Decrypter
To decrypt previously encrypted secrets we use decrypt-secrets.yaml.
It will run the decrypt sops function when we run
KUSTOMIZE_PLUGIN_HOME=$(pwd)/manifests SOPS_IMPORT_PGP=$(cat key.asc) kustomize build --enable_alpha_plugins manifests/site/virtual-airship-core/target/catalogues/