search

viaduct-ai / kustomize-sops

KSOPS - A Flexible Kustomize Plugin for SOPS Encrypted Resources
Apache License 2.0
654 stars 84 forks source link

feat: Generate secrets from templating #264

Open motoki317 opened 3 weeks ago

motoki317 commented 3 weeks ago

Hello ksops team!

This is a (non-breaking) feature pull request to add one advanced feature to the ksops plugin.

I have added usage and usecases to README.md, but in short, this feature allows you to use golang text/template to template a secret from variables read via sops. Please feel free to correct my English in README if anything feels unnatural, because I am not a native English speaker.

My particular usecases include: templating a Gitea app.ini config file. The app.ini is large, and has quite a few fields and a number of secret fields I would like to mask in a git repository. (Since .ini is supported by sops, I guess technically I could use unencrypted_regex to filter out fields in .sops.yaml, but that would get the config file too cluttered. I would personally rather use this templating feature implemented in this PR.)

I have uploaded a built docker image of this PR to ghcr.io/motoki317/ksops so I can try it out in my environment. You can view my refactor commits using this feature from the following links: https://github.com/motoki317/manifest/commit/533de9f596da7154c33c1b7f56773b73669b23c6 https://github.com/motoki317/manifest/commit/570a8f39967a2a3253b0bc4814ef338e3e9f54df

I should also note that this was partially inspired by external-secret's advanced templating feature. https://external-secrets.io/latest/guides/templating/

Thank you in advance!

motoki317 commented 3 weeks ago

@devstein Hi! Would you mind taking a look at this?

devstein commented 3 weeks ago

Hey @motoki317 thanks for the contribution! I'll take a look this weekend.

I generally want to keep KSOPS lean and simply a wrapper around kustomize and SOPS, but think this could makes sense.