OpenFaaS Cloud vNext - User secrets on Kubernetes

openfaas-cloud-vnext.md

OpenFaaS Cloud - Encrypted user secrets for Kubernetes

This Gist shows you how to make use of SealedSecrets in OpenFaaS Cloud. Your secrets can be encrypted with the public key of OpenFaaS Cloud meaning you can commit them to your public or private Git repo. Once deployed the cluster will decrypt them and attach them to your function(s).

0. Before starting you must install the kubeseal binary using the OpenFaaS Cloud CLI extensions:

CLI documentation self-hosted configuration

Here is an example repo which is working end-to-end: https://github.com/alexellis/my-fn

1. Create a new repo under your account username
2. Create function faas new --lang go <name-of-function> --prefix=username
3. Download pub-cert.pem from here, you can commit the cert into your repo if you want because it is public.
4. Update your faas-cli to get the new cloud sub-command
5. Create secrets.yml with faas-cli cloud seal - https://github.com/openfaas/faas-cli#openfaas-cloud-extensions - make sure you prefix the secret with your GitHub username i.e. alexellis-hallo - the suffix is the repo name (not the function name). Inside your function consume the secret passed in to--literal=key=value from /var/openfaas/secrets/key. i.e. faas-cli cloud seal --name alexellis-poker-face --literal key=value
6. Reference the secret in stack.yml without your username this time i.e. - hallo - note this is the name of the repo without your username prefixed. The prefix will be added automatically.
7. Install the GitHub App if you haven't done this already.
8. Do a Git push to trigger a build
9. Await the success status on the commit then click it to follow through to the live link

View your overview page at: http://system.o6s.io/dashboard/username

Troubleshooting

If you get any of the instructions wrong, this will not work - so pay attention and look at the example again if you need to.

Few typo .. pub-cert.yml should be pub-cert.pem and --from-literal=key=value should be --literal=key=value.

I don't see the pem/yaml typo. Where was that?

Number 3: Shouldn't that be pub-cert.pem?

Additional example - https://github.com/alexellis/store-gist

Latest certificate for the community cluster is -> https://raw.githubusercontent.com/openfaas/cloud-functions/master/pub-cert.pem