Mirrors/flux2
1
0
Fork 0
mirror of synced 2026-02-06 19:05:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add GCP docs for Mozilla SOPS

Browse Source 
Signed-off-by: Somtochi Onyekwere <somtochionyekwere@gmail.com>
This commit is contained in:
Somtochi Onyekwere
2021-01-14 13:58:16 +01:00
committed by Hidde Beydals
parent 5d4cdcc207
commit db611549f2
1 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
docs/guides/mozilla-sops.md
View File

@@ -104,13 +104,15 @@ flux create kustomization my-secrets \
Note that the `sops-gpg` can contain more than one key, sops will try to decrypt the Note that the `sops-gpg` can contain more than one key, sops will try to decrypt the
secrets by iterating over all the private keys until it finds one that works. secrets by iterating over all the private keys until it finds one that works.
### AWS/Azure/GCP ### Using various cloud providers
When using AWS/GCP KMS, you'll have to bind an IAM Role with access to the KMS When using AWS/GCP KMS, you'll have to bind an IAM Role with access to the KMS
keys to the `default` service account of the `flux-system` namespace for keys to the `default` service account of the `flux-system` namespace for
kustomize-controller to be able to fetch keys from KMS. kustomize-controller to be able to fetch keys from KMS.
AWS IAM Role example: #### AWS
IAM Role example:
```json ```json
{ {
@@ -131,10 +133,27 @@ AWS IAM Role example:
} }
``` ```
#### Azure
When using Azure Key Vault you need to authenticate the kustomize controller either by passing When using Azure Key Vault you need to authenticate the kustomize controller either by passing
[Service Principal credentials as environment variables](https://github.com/mozilla/sops#encrypting-using-azure-key-vault) [Service Principal credentials as environment variables](https://github.com/mozilla/sops#encrypting-using-azure-key-vault)
or with [add-pod-identity](https://github.com/Azure/aad-pod-identity). or with [add-pod-identity](https://github.com/Azure/aad-pod-identity).
#### Google Cloud
Please ensure that the GKE cluster has Workload Identity enabled.
1. Create a service account with the role `Cloud KMS CryptoKey Encrypter/Decrypter`.
2. Create an IAM policy binding between the GCP service account to the `default` service account of the `flux-system`.
3. Annotate the `default` service account in the `flux-system` with the GCP service account.
```sh
kubectl annotate serviceaccount \
--namespace flux-system \
default \
iam.gke.io/gcp-service-account=<name-of-serviceaccount>@project-id.iam.gserviceaccount.com
```
## GitOps workflow ## GitOps workflow
A cluster admin should create the Kubernetes secret with the PGP keys on each cluster and A cluster admin should create the Kubernetes secret with the PGP keys on each cluster and