CSTDev/helm-kubectl-secrets

Docker image for Helm-Kubernetes + Helm-Secrets

Helm-Kubernetes + Helm-Secrets Docker hub image

Overview

This image is similar to and based on dtzar/helm-kubectl but adds Helm Secrets plugin as well as google cloud cli.

This image is useful to build continuos deployment jobs that can work with encrypted secrets in your helm charts.

Supported Tags

• 2.9.1-gcp, 2.10.0-gcp (helm + kubectl + secrets + google cloud)
• 2.9.1-vanilla, 2.10.0-vanilla (helm + kubectl + secrets without google cloud)
• 2.9.1, latest (legacy tags, at the moment the latest tag is not being updated)

Run

Just like dtzar/helm-kubectl, you can directly run helm:

docker run --rm cousine/helm-kubectl-secrets \
  helm install -f values.yaml stable/mariadb

Better yet, you can leverage Helm Secrets and use helm-wrapper which automatically decrypts all encrypted files within the chart at installation then cleans it up once the installation process is complete:

docker run --rm cousine/helm-kubectl-secrets \
  helm-wrapper install -f encrypted_values.yaml stable/mariadb

Supplying keys

To use Helm Secrets you'll need to import keys into the gpg keyring or setup the correct ENV variables (if you are using GCP KMS for example).

Helm-Kubernetes + Helm-Secrets will automatically import .gpg keys within /root/keys, so all you've to do is mount your key location to /root/keys:

docker run -it -v ~/your-keys-folder:/root/keys cousine/helm-kubectl-secrets \
  helm-wrapper install -f encrypted_values.yaml stable/mariadb

GCP KMS

If you are using GCP KMS, you can place your json key and mount it to the container like the previous step, then define the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to your key:

docker run -it -v ~/your-gcp-key-folder:/root/keys cousine/helm-kubectl-secrets \
  -e GOOGLE_APPLICATION_CREDENTIALS='/root/keys/YOUR_KEY_FILENAME' \
  helm-wrapper install -f encrypted_values.yaml stable/mariadb