Ignores secrets

[mabushey]

This required upgrading to golang 1.13.4. After running make I ran sudo cp /home/ubuntu/bin/kustomize /usr/local/bin to make it accessible to the system.

✗  kustomize version
Version: {KustomizeVersion:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}

Nice build date...

I use sops to encrypt the sample secrets.enc.yaml with CAT and DOG. I'm able to decrypt it fine with sops --decrypt secrets.enc.yaml > secrets.yaml. I add this the to kustomization.yaml:

---
apiVersion: kustomize-sops/v1
kind: SopsSecret
name: my-secret
namespace: bar
source: secrets.enc.yaml
metadata:
  name: not-used
keys:
  - CAT

Then I run kustomize build --enable_alpha_plugins . > test.yaml but there are no secrets in the test.yaml file. No errors, it just ignores the secret.

[mabushey]

It seems like go .so's are so broke there is no reason to use them. I'd much rather compile it as one exe than have two exe's that exactly require each other. What does it take to compile a single exe of Kustomize with kustomize-sops built in?

[donbowman]

https://github.com/Agilicus/kustomize-plugins

is the approach we are using for many things now. It uses the exec plugin via python.

https://github.com/Agilicus/kustomize-plugins/tree/master/agilicus/v1/secretgenerator
https://github.com/Agilicus/kustomize-plugins/tree/master/agilicus/v1/secrettransformer

may be more to your liking.

[donbowman]

This required upgrading to golang 1.13.4. After running make I ran sudo cp /home/ubuntu/bin/kustomize /usr/local/bin to make it accessible to the system.

✗  kustomize version
Version: {KustomizeVersion:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}

Nice build date...

I use sops to encrypt the sample secrets.enc.yaml with CAT and DOG. I'm able to decrypt it fine with sops --decrypt secrets.enc.yaml > secrets.yaml. I add this the to kustomization.yaml:

---
apiVersion: kustomize-sops/v1
kind: SopsSecret
name: my-secret
namespace: bar
source: secrets.enc.yaml
metadata:
  name: not-used
keys:
  - CAT

Then I run kustomize build --enable_alpha_plugins . > test.yaml but there are no secrets in the test.yaml file. No errors, it just ignores the secret.

I will take a look.

[donbowman]

This required upgrading to golang 1.13.4. After running make I ran sudo cp /home/ubuntu/bin/kustomize /usr/local/bin to make it accessible to the system.

✗  kustomize version
Version: {KustomizeVersion:unknown GitCommit:$Format:%H$ BuildDate:1970-01-01T00:00:00Z GoOs:linux GoArch:amd64}

Nice build date...

I use sops to encrypt the sample secrets.enc.yaml with CAT and DOG. I'm able to decrypt it fine with sops --decrypt secrets.enc.yaml > secrets.yaml. I add this the to kustomization.yaml:

---
apiVersion: kustomize-sops/v1
kind: SopsSecret
name: my-secret
namespace: bar
source: secrets.enc.yaml
metadata:
  name: not-used
keys:
  - CAT

Then I run kustomize build --enable_alpha_plugins . > test.yaml but there are no secrets in the test.yaml file. No errors, it just ignores the secret.

It works for me, as below.

$ go version
go version go1.13.7 linux/amd64

can you give me a bit more details? You end up w/ no fields in the output? fields but w/ the encrypted value? fields but w/ the base64 value as below?

$ kustomize build .
apiVersion: v1
data:
  CAT: ZmVyb2Npb3Vz
kind: Secret
metadata:
  name: my-secret-hkbkhc8h2b
  namespace: bar
type: Opaque
don@cube[ca-1]:kustomize-sops$ echo ZmVyb2Npb3Vz | base64 -d -; echo
ferocious
don@cube[ca-1]:kustomize-sops$ cat kustomize_secrets.yaml 
apiVersion: kustomize-sops/v1
kind: SopsSecret
name: my-secret
namespace: bar
source: secrets.enc.yaml
metadata:
  name: not-used
keys:
  - CAT