Secrets Management in CD Environments with GitOps and SOPS

sops --encrypt --kms arn:aws:kms:us-east-1:001301278159:key/b3f4dd5b-a217-46b5-aef2-152fa66be8f4 --encryption-context Role secrets.yaml

Step 5: Configure FluxCD

1. Create a Kubernetes Secret: Create a Kubernetes secret with the PGP keys on each cluster.

2. Add GitRepository and Kustomization Manifests: Add the GitRepository and Kustomization manifests to the fleet repository.

3. Configure Decryption: Configure the Kustomization manifest to use SOPS for decryption:

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: my-secrets
namespace: flux-system
spec:
interval: 10m0s
sourceRef:
  kind: GitRepository
  name: my-secrets
path: ./
prune: true
decryption:
  provider: sops
  secretRef:
    name: sops-gpg

 Step 6: Deploy and Sync

1. Commit and Push Changes: Commit the encrypted secrets and manifests to the Git repository.

2. Sync with FluxCD: FluxCD will pull the changes from the Git repository, decrypt the secrets using SOPS and AWS KMS, and apply them to the cluster.

By following these steps, you can securely manage and deploy Kubernetes secrets using SOPS and AWS KMS with FluxCD.

SOPS with AGE encryption

Step 1: Generate an AGE Key

Generate an AGE key: Use the age-keygen command to create a key pair. This command generates a public and private key.

age-keygen -o age.agekey

Step 2: Configure SOPS

Create .sops.yaml file: This file configures SOPS to use the AGE key for encryption and decryption.

creation_rules:
- encrypted_regex: '^(data|stringData)$'
  age: < public_key >

Step 3: Encrypt Secrets

Encrypt a Kubernetes secret: Use SOPS with the AGE public key to encrypt a secret.

sops --age=< public_key > --encrypt --encrypted-regex '^(data|stringData)$' --in-place basic-auth.yaml

Step 4: Create a Secret in Kubernetes

Create a secret in Kubernetes: Use the AGE private key to create a secret in the flux-system namespace.

cat age.agekey | kubectl create secret generic sops-age --namespace=flux-system --from-file=age.agekey=/dev/stdin

Step 5: Configure Flux

Update the Flux Kustomization: Add the decryption configuration to the Flux Kustomization.

apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
 name: flux-system
 namespace: flux-system
spec:
 interval: 10m0s
 path: ./cluster/base
 prune: true
 sourceRef:
   kind: GitRepository
   name: flux-system
 validation: client
 decryption:
   provider: sops
   secretRef:
       name: sops-age

Step 6: Verify and Use

Verify and use the encrypted secrets: Flux will now use SOPS to decrypt the secrets in the Kubernetes cluster.

This setup ensures that your secrets are encrypted and decrypted securely using AGE and SOPS, and Flux can manage these secrets in your GitOps workflow.

SOPS with Text Files 

Install SOPS and Age: Install SOPS and Age on the machine running Flux. You can get the binaries from their GitHub release pages.

Create a PGP Key: Generate a PGP key using OpenGPG. Make sure not to specify a passphrase if you plan to use this key with Flux.

Configure SOPS: Create a .sops.yaml file in your Git repository to specify the encryption settings. This file defines the rules for encrypting and decrypting files.

Encrypt Files: Use the sops command to encrypt your text files. For example, you can encrypt a file secret.yaml using sops -e -i secret.yaml.

Store Encrypted Files: Store the encrypted files in your Git repository.

Configure Flux: Update your Flux Kustomization to use SOPS for decryption. This involves specifying the decryption provider as sops and referencing the secret containing the decryption key.

Flux will automatically decrypt the secrets when reconciling the cluster state. This ensures that the encrypted secrets are decrypted and applied to the cluster only when needed.

By following these steps, you can securely manage and deploy encrypted text files using SOPS and FluxCD.

SOPS with Structured Data

To use SOPS with structured data using Fluxcd, you can follow these steps:

1. Configure SOPS:

• Install SOPS and age using their documentation.
• Generate a key using age-keygen and create a .sops.yaml file with the public key.

2. Encrypt Secrets:

Encrypt your Kubernetes secrets using SOPS. For example, you can encrypt a secret file like this:

apiVersion: v1
kind: Secret
metadata:
 name: mysqlcreds
type: Opaque
data: null
stringData:
 DB_USER: bugs
 DB_PASSWORD: bunny

Encrypt this file using SOPS:

sops -e mysqlcreds.yaml > mysqlcreds-encrypted.yaml

3. Integrate with Flux:

Configure Flux to use SOPS for decryption. In your gotk-sync.yaml file, add the decryption property:

apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
 name: flux-system
spec:
 interval: 10m0s
 path: ./clusters/my-cluster
 prune: true
 sourceRef:
   kind: GitRepository
   name: flux-system
 decryption:
   provider: sops
   secretRef:
     name: my-private-key

Ensure the secret my-private-key is created correctly and contains the private key.

4. Apply Encrypted Secrets:

• Push the encrypted secret file to your Git repository.
• Flux will pick up the change and reconcile the cluster. The encrypted values should be decrypted and applied correctly.

If decryption does not work, check the Flux logs using flux logs to identify any issues.

By following these steps, you can effectively use SOPS with structured data using Fluxcd for secure and automated secret management in your Kubernetes cluster.

SOPS with HashiCorp Vault

HashiCorp Vault is a secrets manager that provides secure storage and retrieval of secrets. SOPS can be used with HashiCorp Vault for encryption and decryption.

HashiCorp Vault is a secrets manager that provides secure storage and retrieval of secrets. It can be used for encryption, decryption, and signing of data. Vault can be used with various backends, including AWS KMS, GCP KMS, and local file systems.

To manage Kubernetes secrets using SOPS with HashiCorp Vault and Flux, follow these steps:

1. Configure HashiCorp Vault:

• Set up HashiCorp Vault as your identity-based secrets and encryption management system.
• Enable the transit backend in Vault to use it for encryption.

2. Encrypt Secrets with SOPS: Export the VAULT_ADDR and VAULT_TOKEN environment variables to your shell.

Use sops to encrypt a Kubernetes Secret, specifying the Vault address and token:

sops --hc-vault-transit $VAULT_ADDR/v1/sops/keys/my-encryption-key --encrypt \
--encrypted-regex '^(data|stringData)$' --in-place basic-auth.yaml

3. Create a Secret for the Vault Token: Create a secret for the Vault token using kubectl:

echo $VAULT_TOKEN | kubectl create secret generic sops-hcvault \
--namespace=flux-system --from-file=sops.vault-token=/dev/stdin