SOPS Operator
A Kubernetes operator for Mozilla SOPS.
Overview
Put SOPS-encrypted data into a SopsSecret which can then be committed to a Git repository.
Once deployed on a Kubernetes cluster, the SOPS Operator will decrypt the data and create a standard Kubernetes Secret from it.
Example for a SopsSecret:
apiVersion: craftypath.github.io/v1alpha1
kind: SopsSecret
metadata:
name: test-secret
spec:
metadata:
labels:
mylabel: mylabelvalue
annotations:
myannotation: myannotationvalue
stringData:
test.yaml: |
test: ENC[AES256_GCM,data:xo8jZTsQ,iv:DTouw1kgBLok6BbR5vx8366fFavV70QeCWGNQPhNb9s=,tag:RAjeoNhvGUezdOS4YOorfA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv:
- vault_url: https://myakskeyvault12345567.vault.azure.net
name: sops
version: 08faa451b1d04b8bacec0395fc8539f1
created_at: '2020-05-01T19:42:49Z'
enc: DvZNm3tfyoyWibQcVPts9ODRPs3aaHbRaXOPIx1Ukypa2nPmU4RCTchBPUoqscIxDjKpSy9k6A_dfE8XAu8-XrEyuOGCEy-i6Q1OtZSGW1XnWfWXPic5TF7XCVz_08h1My1RzVUr51PPNX9uazCqQeUTfBx05KC1bT3entgfttHp-98uZkZNaI8IUUnPGCH8bZzthsXRSvRQpbZcNoOW3y04pLAVYN3xVSOdDWQSElmntg_t7eVdCsmj4iXrC-J80VPU6BoZetcsQhOLjAhXHEYMOP7fqjd2bXob59Ad8rblUDwwtcZrku5lF_LVvAKGBURxockQXmEuVAjqha1SyA
lastmodified: '2020-05-01T19:42:50Z'
mac: ENC[AES256_GCM,data:L4YfHJ59L+/YFMTizeSmEz3QiFbNYoRBVeAJNbHOCUU0W7Iv/WfGnZuNnG5c3gOELYafc812CxCFHYwoLK0bLxOd+KHwGp5IBZ7zqrg91e04V/7Tc3iEYCE3YuTQZ56XMeSSKsct7HT7jxzmVMjW0ozJ06vzQCEC/Ljsl2NfFNs=,iv:RiBXtk6Gpc/MZvDRaGKlvA8A0K7E7bGdhs8tVa6LL5w=,tag:hwnh954tiRC/VBp6LQ6nPg==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.5.0Here's the Secret that's created from it:
apiVersion: v1
kind: Secret
metadata:
name: test-secret
labels:
mylabel: mylabelvalue
annotations:
myannotation: myannotationvalue
data:
test.yaml: dGVzdDogdGVzdHZhbHVlCg==Installation
A Helm chart is available in our charts repo at https://github.com/craftypath/helm-charts.
helm repo add craftypath https://craftypath.github.io/helm-charts
helm install craftypath/sops-operatorCheck out the chart's documentation for configuration options.