Encrypted Secrets in Helm Charts

Wed, 11 Aug 2021 08:00:44 +0000

In my recent article “How to encrypt Kubernetes secrets with Mozilla SOPS ”, I demonstrated how to encrypt regular Kubernetes secret manifests (yaml) using SOPS CLI in conjunction with Azure Key Vault as the backend for the encryption-key.

This post will take it one step further; it guides you through the process of creating a custom Helm chart that will reference encrypted secrets. In the end, you will be able to add your encrypted secrets to source control without leaking sensitive information.

Encrypt your Kubernetes Secrets with Mozilla SOPS

Tue, 03 Aug 2021 12:59:24 +0200

By default, Kubernetes Secrets (secrets) are stored with base64 encoding in YAMLfiles. The lack of encryption for secrets often leads to the question of how to store secrets securely. Obviously, you don’t want to put your sensitive configuration data into a git repository, because it is just encoded. echo <base64_representation> | base64 -d.

A typical solution is using services like Azure Key Vault , or HashiCorp Vault to persist sensitive data. Those services can be integrated with Kubernetes by using the Secrets Store CIS driver . However, relying on an additional service means that you have to manage and maintain that service in addition to Kubernetes. Additionally, depending on the service you use to store your sensitive data, some sensitive configuration must be stored somewhere to configure the CIS driver.

GitOps on Thorsten Hans

Encrypted Secrets in Helm Charts

Encrypt your Kubernetes Secrets with Mozilla SOPS