rroblak

Encrypting Kubernetes Secrets with Age and SOPS on k3s

SOPS is a handy utility for encrypting sensitive content within files while making it easy to edit and track them with standard developer tools (git, diff, vi, etc.). Using the sops-secret-operator, you can deploy encrypted Kubernetes secrets as SopsSecret custom resources, which are decrypted by the operator and made available as standard Secrets for general consumption. This allows secrets to be tracked securely in version control, deployed with standard CI/CD tools, and edited securely by developers.

Comparison to Alternatives

KSOPS

KSOPS is a Kustomize plugin that supports decrypting SOPS files and applying them to your cluster.

Local (OS X) Side

`~/Library/LaunchAgents/pbcopy.plist`

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
     <key>Label</key>
     <string>localhost.pbcopy</string>

Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.

Discussion on reddit.

Python 2.x

$ python -m SimpleHTTPServer 8000

	import java.io.PrintWriter

	import cascading.stats.CascadingStats
	import com.twitter.scalding._

	/**
	* Writes all custom counters into a tsv file args("counters-file") if this property is set.
	*
	* Output format:
	* counter_name value