@@ -823,33 +823,46 @@ For more information, see [remote clusters/Cluster-API](#remote-clusterscluster-
823823
824824# ## Decryption
825825
826- ` .spec.decryption ` is an optional field to specify the configuration to decrypt
827- Secrets, ConfigMaps and patches that are a part of the Kustomization .
826+ Storing Secrets in Git repositories in plain text or base64 is unsafe,
827+ regardless of the visibility or access restrictions of the repository .
828828
829- Since Secrets are either plain text or `base64` encoded, it's unsafe to store
830- them in plain text in a public or private Git repository. In order to store
831- them safely, you can use [Mozilla SOPS](https://github.com/mozilla/sops) and
832- encrypt your Kubernetes Secret data with [age](https://age-encryption.org/v1/)
833- and/or [OpenPGP](https://www.openpgp.org) keys, or with provider implementations
834- like Azure Key Vault, GCP KMS or Hashicorp Vault.
829+ In order to store Secrets safely in Git repositorioes you can use an
830+ encryption provider and the optional field `.spec.decryption` to
831+ configure decryption for Secrets that are a part of the Kustomization.
835832
836- Also, you may want to encrypt some parts of resources as well. In order to do that,
837- you may encrypt patches as well.
833+ The only supported encryption provider is [SOPS](https://getsops.io/).
834+ With SOPS you can encrypt your secrets with [age](https://github.com/FiloSottile/age)
835+ or [OpenPGP](https://www.openpgp.org) keys, or with keys from Key Management Services
836+ (KMS), like AWS KMS, Azure Key Vault, GCP KMS or Hashicorp Vault.
838837
839838**Note:** You must leave `metadata`, `kind` or `apiVersion` in plain text.
840- An easy way to do this is to limit encrypted keys by appending `--encrypted-regex '^(data|stringData)$'`
841- to your `sops -- encrypt` command.
839+ An easy way to do this is limiting the encrypted keys with the flag
840+ ` --encrypted-regex '^(data|stringData)$' ` in your `sops encrypt` command.
842841
843- It has two fields
842+ The `.spec.decryption` field has the following subfields
844843
845844- `.provider` : The secrets decryption provider to be used. This field is required and
846845 the only supported value is `sops`.
847- - `.secretRef.name` : The name of the secret that contains the keys to be used for
848- decryption. This field can be omitted when using the
849- [global decryption](#controller-global-decryption) option.
846+ - `.secretRef.name` : The name of the secret that contains the keys or cloud provider
847+ static credentials for KMS services to be used for decryption.
848+ - `.serviceAccountName` : The name of the service account used for
849+ secret-less authentication with KMS services from cloud providers.
850+ See the [workload identity](/flux/installation/configuration/workload-identity/) docs
851+ for how to configure a cloud provider identity for this service account.
852+
853+ If a static credential for a given cloud provider is defined inside the secret
854+ referenced by `.secretRef`, that static credential takes priority over secret-less
855+ authentication for that provider. If no static credentials are defined for a given
856+ cloud provider inside the secret, secret-less authentication is attempted for that
857+ provider.
858+
859+ If `.serviceAccountName` is specified for secret-less authentication,
860+ it takes priority over [controller global decryption](#controller-global-decryption)
861+ for all cloud providers.
862+
863+ Example :
850864
851865` ` ` yaml
852- ---
853866apiVersion: kustomize.toolkit.fluxcd.io/v1
854867kind: Kustomization
855868metadata:
@@ -863,13 +876,11 @@ spec:
863876 name: repository-with-secrets
864877 decryption:
865878 provider: sops
879+ serviceAccountName: sops-identity
866880 secretRef:
867- name: sops-keys
881+ name: sops-keys-and-credentials
868882` ` `
869883
870- **Note:** For information on Secrets decryption at a controller level, please
871- refer to [controller global decryption](#controller-global-decryption).
872-
873884The Secret's `.data` section is expected to contain entries with decryption
874885keys (for age and OpenPGP), or credentials (for any of the supported provider
875886implementations). The controller identifies the type of the entry by the suffix
@@ -880,7 +891,7 @@ of the key (e.g. `.agekey`), or a fixed key (e.g. `sops.vault-token`).
880891apiVersion: v1
881892kind: Secret
882893metadata:
883- name: sops-keys
894+ name: sops-keys-and-credentials
884895 namespace: default
885896data:
886897 # Exemplary age private key
@@ -937,9 +948,9 @@ metadata:
937948 namespace: default
938949data:
939950 sops.aws-kms: |
940- aws_access_key_id: some-access-key-id
941- aws_secret_access_key: some-aws-secret-access-key
942- aws_session_token: some-aws-session-token # this field is optional
951+ aws_access_key_id: some-access-key-id
952+ aws_secret_access_key: some-aws-secret-access-key
953+ aws_session_token: some-aws-session-token # this field is optional
943954` ` `
944955
945956# ### Azure Key Vault Secret entry
@@ -1408,6 +1419,8 @@ it is possible to specify global decryption settings on the
14081419kustomize-controller Pod. When the controller fails to find credentials on the
14091420Kustomization object itself, it will fall back to these defaults.
14101421
1422+ See also the [workload identity](/flux/installation/configuration/workload-identity/) docs.
1423+
14111424# ### AWS KMS
14121425
14131426While making use of the [IAM OIDC provider](https://eksctl.io/usage/iamserviceaccounts/)
0 commit comments