schmiddim/foo.md

## foo.md

      
    Raw
  

              foo.md
            
          
    Sealed Secrets

Installation

Setup k8

helm upgrade --install sealed-secrets --namespace kube-system --version 1.16.1 sealed-secrets/sealed-secrets

Binary for Encryption

wget https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.16.0/kubeseal-linux-amd64 -O kubeseal
sudo install -m 755 kubeseal /usr/local/bin/kubeseal

Usage


Get the PEM for signing secrets - we will use this to sign the secrets

kubeseal  --controller-name=sealed-secrets  --controller-namespace=kube-system  --fetch-cert > /tmp/mycert.pem


Echo a simple K8 secret

kubectl create secret generic secret-name --dry-run  --from-literal=foo=bar -oyaml


Create and sign the secret  - check the yaml output!

kubectl create secret generic secret-name --dry-run=client  --from-literal=foo=bar -oyaml| \
 kubeseal --controller=sealed-secrets --controller-namespace=kube-system --format yaml --cert mycert.pem  
 > my-super-encrypted-secret.yaml


Apply secret
kubectl create -f my-super-encrypted-secret.yaml


Test if it decrypts


kubectl get secret secret-name -ojsonpath='{.data.foo}'|base64 -d