History

Sirajudeen 0150d774d3 Rename Virtual Sites in Treasuremap * Renamed test-site to virtual-airship-core Relates-To: #154 Change-Id: I15905a5be8628b35f1cebcba95e3257f541d4e74		2021-07-12 19:01:49 +00:00
..
generator	Adding a place for external secrets to be stored on site level	2021-05-20 05:34:19 +00:00
importer	Adding a place for external secrets to be stored on site level	2021-05-20 05:34:19 +00:00
results	Merge "Treasuremap- Dex bind_password updated for subclusters"	2021-07-09 19:51:58 +00:00
README.md	Rename Virtual Sites in Treasuremap	2021-07-12 19:01:49 +00:00

README.md

Secrets generator/encrypter/decrypter

This directory contains an utility that helps generate, encrypt and decrypt secrects. These secrects can be used anywhere in manifests.

For example we can use PGP key from SOPS example. To get the key we need to run: curl -fsSL -o key.asc https://raw.githubusercontent.com/mozilla/sops/master/pgp/sops_functional_tests_key.asc

and import this key as environment variable: export SOPS_IMPORT_PGP="$(cat key.asc)" && export SOPS_PGP_FP="FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4"

Generator

To generate secrets we use template that will be passed to kustomize as generators during airshipctl phase run secret-generate execution.

Encrypter

To encrypt the secrets that have been generated we use generic container executor. To start the secrets generate phase we need to execute following phase: airshipctl phase run secret-generate The executor run SOPS container and pass the pre-generated secrets to this container. This container encrypt the secrets and write it to directory specified in kustomizeSinkOutputDir(results/generated).

Decrypter

To decrypt previously encrypted secrets we use decrypt-secrets.yaml. It will run the decrypt sops function when we run KUSTOMIZE_PLUGIN_HOME=$(pwd)/manifests SOPS_IMPORT_PGP=$(cat key.asc) kustomize build --enable_alpha_plugins manifests/site/virtual-airship-core/target/catalogues/