search

jkroepke / helm-secrets

A helm plugin that help manage secrets with Git workflow and store them anywhere
https://github.com/jkroepke/helm-secrets/wiki
Apache License 2.0
1.53k stars 129 forks source link

[Question] Passing VAULT_NAMESPACE env var in helm-secrets plugin with ArgoCD #419

Closed jaythamke closed 11 months ago

jaythamke commented 1 year ago

Hello Jan, I am currently testing some scenarios in our CD workflow with ArgoCD. I am already using helm-secrets plugin along with sops for managing the secrets since two years. Thanks for your efforts. In my current scenario, the secrets encryption and decryption are done by the keys stored in Hashicorp Vault (Enterprise version) Transit engines and the keys are separated by using Vault namespaces (e.g. /dev/, /staging/ etc. ) (defined by VAULT_NAMESPACE env variable).

I would like to know how to pass VAULT_NAMESPACE and VAULT_TOKEN env var to argocd-repo-server from ArgoCD Application.

jkroepke commented 1 year ago

ArgoCD App are not able to inject environment variables.

Do you have separat VAULT_TOKEN for each Application?

jaythamke commented 1 year ago

Do you have separat VAULT_TOKEN for each Application?

Yes, I have to create new VAULT_TOKEN for each VAULT_NAMESPACE

jaythamke commented 1 year ago

ArgoCD App are not able to inject environment variables.

Thanks for quick reply! In that case, I think I have to come up with argocd-plugin like solution (provided in https://argocd-vault-plugin.readthedocs.io/en/stable/usage/) and then rendering K8s manifests by executing helm secrets template -f my-sops-enc-secret.yaml -f some-other-values.yaml inside configManagementPlugins.[].generate in ArgoCD config management plugin.

github-actions[bot] commented 11 months ago

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

jaythamke commented 11 months ago

Closing as query is resolved