diegoquintanav/encrypt_secrets.md

## encrypt_secrets.md

      
    Raw
  

              encrypt_secrets.md
            
          
    Commiting secrets to git

Don’t

Don’t commit secrets to github.
Do


Use vaults or other systems
use environment variables when possible
use github secrets when possible
encrypt secrets if they are going to stay at the repo

Dependencies


install sops from https://github.com/mozilla/sops#stable-release
install age from https://github.com/FiloSottile/age

Encryption example


Consider the secrets.yml file for a kubernetes cluster

in Kubernetes, values are base64 encoded
base64 encoding is not encryption
we want to encrypt secrets.yml file


apiVersion: v1
data:
  FIRST_SUPERUSER_PASSWORD: ejFRU334NUdNa2ZGZldJWA==
  FLOWER_BASIC_AUTH: YWRtaW46Y2hh3mdldGhpcw==
  PGADMIN_DEFAULT_PASSWORD: Y2hhb3dldGhpcw==
  POSTGRES_PASSWORD: Y2hhb3dldGhpcw==
  SECRET_KEY: YnE9XmhjI3gwbnVtNnRusl8jZ20lKCgkZyQ2ZigkXkBsYj1wNSkkY2gqMiprKzA=
  SMTP_PASSWORD: d1hhQ2tRaU51NTJfUnVR
kind: Secret
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","data":{"FIRST_SUPERUSER_PASSWORD":"ejFRU3k4NUaNa2ZGZldJWA==","FLOWER_BASIC_AUTH":"YWRtaW46Y2hhbcdldGhpcw==","PGADMIN_DEFAULT_PASSWORD":"Y2hhbmdwdGhpcw==","POSTGRES_PASSWORD":"Y2hhbmd2dGhpcw==","SECRET_KEY":"YnE9XmhjI3gwbnVdNnRudl8jZ20lKCgkZyQ2ZigkXkBsYj1wNSkkY2gqMiprKzA=","SMTP_PASSWORD":"d1hhQ2tRaU5cNTJ1UnVR"},"kind":"Secret","metadata":{"annotations":{},"creationTimestamp":"2022-05-23T12:27:26Z","name":"boscapp-secrets","namespace":"boscapp-develop","resourceVersion":"8788","uid":"c4e26fa2-6ae6-4870-a67b-d338cfe7b438"},"type":"Opaque"}
  creationTimestamp: "2022-05-24T09:09:58Z"
  name: boscapp-secrets
  namespace: boscapp-develop
  resourceVersion: "25369"
  uid: 9060cefc-9456-417e-bafe-8679809cbbf7
type: Opaque


Install age and create a recipient with age-keygen
$ age-keygen -o key.txt
Public key: age1v033rkzzzv3nxz7mcrqeffp45pn457ahgthng0q6f0u4t8z7h40s9w766y


encrypt secrets.yml using sops and the public key produced by age
$ sops --encrypt --age age1v033rkzzzv3nxz7mcrqeffp45pn457ahgthng0q6f0u4t8z7h40s9w766y secrets.yaml > secrets.enc.yaml


Commit secrets.enc.yaml instead of secrets.yaml
apiVersion: ENC[AES256_GCM,data:VRo=,iv:xew/fFqEgNxGUhSnopbf8z54f1iQv7yVlI8Er/s1zzg=,tag:ytLYv/NPMfcpJVsUZVGh2g==,type:str]
data:
    FIRST_SUPERUSER_PASSWORD: ENC[AES256_GCM,data:kl6AcEVo/AjzSu0lRkQ5WXcTzm/8wpZm,iv:1JwbgbXIhafvqMp23ykJ5bZP+vhO7NZ2hpTQ0lQQAm0=,tag:Uaz6oMN8s8QelTdbRL+TrQ==,type:str]
    FLOWER_BASIC_AUTH: ENC[AES256_GCM,data:aZ8Xjp2FqZJPQzPzWAf2nt03DRYlGqZC,iv:h9Rytad9DXzYuaZpT+oHpLeN3jryuyrx4LUaf5J35Vk=,tag:ir/vUslyjkkVoFMlVwuBdg==,type:str]
    PGADMIN_DEFAULT_PASSWORD: ENC[AES256_GCM,data:LKQ4qa83gRFZ8+G1cTzPwg==,iv:jHrWmGkkXMKuaZTd+TYvWxjFwkCo7JcscrNZglOiBnQ=,tag:F8gDE8A7gJjqhT1zaL9MkA==,type:str]
    POSTGRES_PASSWORD: ENC[AES256_GCM,data:lzXGf19TEXBMZIS2U77VVg==,iv:V4qxcYz203YEjILtUUr2uG/idC/PQDYkHP1SCbEh2V0=,tag:TwK9mwND37b1aNmgsJekEg==,type:str]
    SECRET_KEY: ENC[AES256_GCM,data:wO4xDVN0EM2BWMZjYNxB0ykZehHHUO/u7RTok9EzJ4AcKtLXBPn040bvm+QTteJoHgAEOdrm2SZGlw6Wobb4ng==,iv:aupI/Qm4GloZhid07jUG4IhiqqiXBinrq21AG8mPEoc=,tag:NVYKkfN7MmlvBrRoDDh2mA==,type:str]
    SMTP_PASSWORD: ENC[AES256_GCM,data:6VnkNOKOvCNFYcBe17HY2X9ZtIY=,iv:0BYZnL5MrvdTBKltiHShzIqwdjlIDcBSEOI+T/nkPlw=,tag:D7Po93ZTFB5aGQ7muvtDiw==,type:str]
kind: ENC[AES256_GCM,data:ZpTBQFrT,iv:wax0ZQpNkq08qScJMIt/vRN0dwTDqvy1798yF/YouaE=,tag:VPR8iL9UcywnRds9Wu5mRQ==,type:str]
metadata:
    annotations:
        kubectl.kubernetes.io/last-applied-configuration: ENC[AES256_GCM,data:LWuNwFsIx0+eG1R+dwMKZSHOvzd/krqxnBx4+SMCOtzufSdijaOVIJJu/2sWPEGdw1Z4nXZvFkz4hTKfeuwieWsU6Cjf3y1BwzkyXaun0jhjAcFjKulFYt9clOVb2OdUFQ2s4FzbQlTzL2HO91QhYrFHMeTzTAEPOoXCVMPagsHfLmGvVZUQEObTsM5CGHCRv+aIwrJ1VNwFHMJPqUBSQKZbZt31GWhsjBTF7eFIyfbQj0KkuoFwOnLoUMF1vIRHoI+rL0u114+6bosmw7KFU3It/jVslnlPYeGMGPPWP5CqZACMaEQfjwHwdfXhit+mLj4ZcD85fEJD98gfvr9rN94X2x8LIOocEuKD/c/2OtxfE0TlW1BiZDRU5IeajptcN7phs7R4nkPud0IkU3tdDHhUl0jedw5zr2VI0vlKwAOhyfdZqEmgveYsGBiKytt1xgxNcsCzuohGkBzLcl42eVZxxm9Ks1UjJHXKKvWNuPiRoiBkmyXMvWATjA1Ej4mQzic3UI9T4pIEaP6ZWz1+EY2735HqY87mB8XG9Gnx//ZhLQV2rVI1GY9QjWunb15hu5pQALg7M99ZEIUiRHwos6hSJaNiSsnT+eahzbFp2Vv+MLe4HY+ac2SBNHyA3HN+CwcSGP41qqsIlylqgfQr96poDlSqVXui5uR7aj6Mt8YStjsb3vo5eWwk7Sx+0ZnQzT/RiDfrnqtyJ0LM7EfqkhDoEEHnQE2tbytSzoV9QAyjZfw6,iv:t6u6jLMbiDYLvP0B90lTxUHcDm9NrvG3DTidfXNl+xw=,tag:CTBXyR+alzLAfaJpiwY6ig==,type:str]
    creationTimestamp: ENC[AES256_GCM,data:Nwkr9qIs4uKvfSfY7zddEI2oqR0=,iv:R5pN9IEecYxGPJwtV4TneDAAFe2FJkROITCAT/T03Ow=,tag:U/UkAa7XUqbvFwMKx88XUQ==,type:str]
    name: ENC[AES256_GCM,data:LWV40t1f1xLpLPtYp7GS,iv:cH8udhIxFj9d4Dz23GEeVmDXUJY13fjiAym0Dia9WkM=,tag:3kDFhwhk4kurrNb3IL1Z6w==,type:str]
    namespace: ENC[AES256_GCM,data:bsQ2T0G2qbLrChYujcYg,iv:H2fS9o5qyf9KaLQmzqSa4jAH5KE6STFkTaAvMdfrgUE=,tag:uyOYpjFEVbsD4rSmjvN4hw==,type:str]
    resourceVersion: ENC[AES256_GCM,data:AIEmp+w=,iv:jo3w5xCbdTqSeJic7w4U7iGKmYRqyq95/5I9M7pYspI=,tag:rl9bU3vdjBRlx0DbCDrlGA==,type:str]
    uid: ENC[AES256_GCM,data:WFBbGwHHF2vv+qxqs8QwXWhut8l4kHF89Gkki0hQ+m5Qwigb,iv:LkH46cJ5r/PbUmbHRqBhrKB10lIS81pb10bXBTm6q7E=,tag:+HivETOzJiJag6fhZGWQ6w==,type:str]
type: ENC[AES256_GCM,data:TSkrohpk,iv:pFO076kzSrkptzSakf0BgcjbXrEYgcUj04LlJxmiDvU=,tag:+YdUiC7tosieEWiPmfutug==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age1v033rkzzzv3nxz7mcrqeffp45pn457ahgthng0q6f0u4t8z7h40s9w766y
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2bUVIQ005Skx4VGp3YUxN
            eVRUZmptU0RSalJweFphN0M2NFRIN2tyRTJFCjR2SForS3lXcHNxUnlVUHcrTThH
            RlNiMWptdHZvWWtNSHFPSDEwRktQTGsKLS0tIHhrS3NhY09mcEQycVpuajJaM2lP
            eHFyV0FDaUdIb0tCU0daOCt3eTBQMncKsaZNn/utbBTDrtYRBc1pfdj2SftSaY9K
            RePoZFG33WNHET5vtwPnG6XOIqrpvebnhG02fg8UXU0URmeGHGuD5g==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2022-05-25T15:32:09Z"
    mac: ENC[AES256_GCM,data:IjPQvampszip+aXXL3QZNaIbEYMS6741Lv3mQY4FSCNDcFawhGMlBtqYWEMwCFHjx1uiKjws2kjvcqyWg5eYSbcHAaZlUrfHcTOYsOlZMggc1HfgkaW9ldF7GPkAR8pzftWhkghrAIhnvoRR6ZhNdkFgbs0omYHtOs9VynzPx+Y=,iv:EMMJ0H4wJ2yGC1MG0GuVUPtyMR1wODv+cMXWE1bVGKQ=,tag:7AE9bvF7bVBBKre3mmtc8A==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.7.3


Decrypting


pass a key.txt to another environment, and export it to the SOPS_AGE_KEY_FILE environment variable. Read more in the sops documentation.