mirror of
https://github.com/marcel-dempers/docker-development-youtube-series.git
synced 2025-06-06 17:01:30 +00:00
updates to sealed secrets
This commit is contained in:
marcel-dempers
parent
655764b074
commit
84890e84c3
@ -4,7 +4,7 @@ Checkout the [Sealed Secrets GitHub Repo](https://github.com/bitnami-labs/sealed
|
|||||||
|
|
||||||
## Create a kubernetes cluster
|
## Create a kubernetes cluster
|
||||||
|
|
||||||
In this guide we we''ll need a Kubernetes cluster for testing. Let's create one using [kind](https://kind.sigs.k8s.io/) </br>
|
In this guide we we'll need a Kubernetes cluster for testing. Let's create one using [kind](https://kind.sigs.k8s.io/) </br>
|
||||||
|
|
||||||
```
|
```
|
||||||
kind create cluster --name sealedsecrets --image kindest/node:v1.23.5
|
kind create cluster --name sealedsecrets --image kindest/node:v1.23.5
|
||||||
@ -34,6 +34,15 @@ chmod +x ./kubectl
|
|||||||
mv ./kubectl /usr/local/bin/kubectl
|
mv ./kubectl /usr/local/bin/kubectl
|
||||||
```
|
```
|
||||||
|
|
||||||
|
### install helm
|
||||||
|
|
||||||
|
```
|
||||||
|
curl -o /tmp/helm.tar.gz -LO https://get.helm.sh/helm-v3.10.1-linux-amd64.tar.gz
|
||||||
|
tar -C /tmp/ -zxvf /tmp/helm.tar.gz
|
||||||
|
mv /tmp/linux-amd64/helm /usr/local/bin/helm
|
||||||
|
chmod +x /usr/local/bin/helm
|
||||||
|
```
|
||||||
|
|
||||||
### test cluster access:
|
### test cluster access:
|
||||||
```
|
```
|
||||||
/work # kubectl get nodes
|
/work # kubectl get nodes
|
||||||
@ -53,40 +62,52 @@ curl -L -o ./kubernetes/secrets/sealed-secrets/controller-v0.19.1.yaml https://g
|
|||||||
|
|
||||||
```
|
```
|
||||||
|
|
||||||
### alternative install Helm
|
### install using Helm
|
||||||
|
|
||||||
TODO: cover helm https://github.com/bitnami-labs/sealed-secrets#helm-chart
|
You can also install the controller using `helm`
|
||||||
|
|
||||||
### install the controller
|
```
|
||||||
|
helm repo add sealed-secrets https://bitnami-labs.github.io/sealed-secrets
|
||||||
|
helm search repo sealed-secrets --versions
|
||||||
|
helm template sealed-secrets --version 2.7.0 -n kube-system sealed-secrets/sealed-secrets \
|
||||||
|
> ./kubernetes/secrets/sealed-secrets/controller-helm-v0.19.1.yaml
|
||||||
|
|
||||||
|
```
|
||||||
|
With `helm template` we can explore the YAML and then replace the `helm template` with `helm install`
|
||||||
|
to install the chart
|
||||||
|
|
||||||
|
### install using YAML manifest
|
||||||
|
|
||||||
```
|
```
|
||||||
kubectl apply -f kubernetes/secrets/sealed-secrets/controller-v0.19.1.yaml
|
kubectl apply -f kubernetes/secrets/sealed-secrets/controller-v0.19.1.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
### Check the install
|
### Check the installation
|
||||||
|
|
||||||
|
The controller deploys to the `kube-system` namespace by default.
|
||||||
|
|
||||||
```
|
```
|
||||||
kubectl -n kube-system get pods
|
kubectl -n kube-system get pods
|
||||||
```
|
```
|
||||||
|
|
||||||
TODO: check the logs with `kubectl -n kube-system logs` command
|
Check the logs of the sealed secret controller
|
||||||
|
|
||||||
TODO: important logs
|
```
|
||||||
|
kubectl -n kube-system logs -l name=sealed-secrets-controller --tail -1
|
||||||
|
```
|
||||||
|
|
||||||
|
From the logs we can see that it writes the encryption key its going to use as a kubernetes secret </br>
|
||||||
|
Example log:
|
||||||
|
|
||||||
```
|
```
|
||||||
2022/11/05 21:38:20 New key written to kube-system/sealed-secrets-keymwzn9
|
2022/11/05 21:38:20 New key written to kube-system/sealed-secrets-keymwzn9
|
||||||
2022/11/05 21:38:20 Certificate is
|
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
< cert content >
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
|
|
||||||
2022/11/05 21:38:20 HTTP server serving on :808
|
|
||||||
```
|
```
|
||||||
|
|
||||||
TODO: check our secret
|
## Encryption keys
|
||||||
|
|
||||||
```
|
```
|
||||||
kubectl get secret -n kube-system sealed-secrets-keymwzn9 -o yaml
|
kubectl -n kube-system get secrets
|
||||||
|
kubectl -n kube-system get secret sealed-secrets-keygxlvg -o yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
## Download KubeSeal
|
## Download KubeSeal
|
||||||
@ -97,16 +118,11 @@ we'll want to download kubeseal from the assets section
|
|||||||
|
|
||||||
curl -L -o /tmp/kubeseal.tar.gz \
|
curl -L -o /tmp/kubeseal.tar.gz \
|
||||||
https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.19.1/kubeseal-0.19.1-linux-amd64.tar.gz
|
https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.19.1/kubeseal-0.19.1-linux-amd64.tar.gz
|
||||||
|
|
||||||
apk add tar
|
|
||||||
tar -xzf /tmp/kubeseal.tar.gz -C /tmp/
|
tar -xzf /tmp/kubeseal.tar.gz -C /tmp/
|
||||||
|
|
||||||
chmod +x /tmp/kubeseal
|
chmod +x /tmp/kubeseal
|
||||||
mv /tmp/kubeseal /usr/local/bin/
|
mv /tmp/kubeseal /usr/local/bin/
|
||||||
```
|
```
|
||||||
|
|
||||||
### run kubeseal
|
|
||||||
|
|
||||||
We can now run `kubeseal --help`
|
We can now run `kubeseal --help`
|
||||||
|
|
||||||
## Sealing a basic Kubernetes Secret
|
## Sealing a basic Kubernetes Secret
|
||||||
@ -117,13 +133,18 @@ Looks at our existing Kubernetes secret YAML
|
|||||||
cat kubernetes/secrets/secret.yaml
|
cat kubernetes/secrets/secret.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
Create a sealed secret using `stdin`
|
If you run `kubeseal` you will see it pause and expect input from `stdin`. </br>
|
||||||
|
You can paste your secret YAML and press CTRL+D to terminate `stdin`. </br>
|
||||||
|
You will notive it writes a `sealedSecret` to `stdout`. </br>
|
||||||
|
We can then automate this using `|` characters. </br>
|
||||||
|
|
||||||
|
Create a sealed secret using `stdin` :
|
||||||
|
|
||||||
```
|
```
|
||||||
cat kubernetes/secrets/secret.yaml | kubeseal -o yaml > kubernetes/secrets/sealed-secrets/sealed-secret.yaml
|
cat kubernetes/secrets/secret.yaml | kubeseal -o yaml > kubernetes/secrets/sealed-secrets/sealed-secret.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
Create a sealed secret using file
|
Create a sealed secret using a YAML file:
|
||||||
|
|
||||||
```
|
```
|
||||||
kubeseal -f kubernetes/secrets/secret.yaml -o yaml > kubernetes/secrets/sealed-secrets/sealed-secret.yaml
|
kubeseal -f kubernetes/secrets/secret.yaml -o yaml > kubernetes/secrets/sealed-secrets/sealed-secret.yaml
|
||||||
|
|||||||
278
kubernetes/secrets/sealed-secrets/controller-helm-v0.19.1.yaml
Normal file
278
kubernetes/secrets/sealed-secrets/controller-helm-v0.19.1.yaml
Normal file
@ -0,0 +1,278 @@
|
|||||||
|
---
|
||||||
|
# Source: sealed-secrets/templates/service-account.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: sealed-secrets
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: sealed-secrets
|
||||||
|
helm.sh/chart: sealed-secrets-2.7.0
|
||||||
|
app.kubernetes.io/instance: sealed-secrets
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/version: v0.19.1
|
||||||
|
---
|
||||||
|
# Source: sealed-secrets/templates/cluster-role.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: secrets-unsealer
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: sealed-secrets
|
||||||
|
helm.sh/chart: sealed-secrets-2.7.0
|
||||||
|
app.kubernetes.io/instance: sealed-secrets
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/version: v0.19.1
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- bitnami.com
|
||||||
|
resources:
|
||||||
|
- sealedsecrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- bitnami.com
|
||||||
|
resources:
|
||||||
|
- sealedsecrets/status
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- create
|
||||||
|
- update
|
||||||
|
- delete
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
|
---
|
||||||
|
# Source: sealed-secrets/templates/cluster-role-binding.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: sealed-secrets
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: sealed-secrets
|
||||||
|
helm.sh/chart: sealed-secrets-2.7.0
|
||||||
|
app.kubernetes.io/instance: sealed-secrets
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/version: v0.19.1
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: secrets-unsealer
|
||||||
|
subjects:
|
||||||
|
- apiGroup: ""
|
||||||
|
kind: ServiceAccount
|
||||||
|
name: sealed-secrets
|
||||||
|
namespace: kube-system
|
||||||
|
---
|
||||||
|
# Source: sealed-secrets/templates/role.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: sealed-secrets-key-admin
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: sealed-secrets
|
||||||
|
helm.sh/chart: sealed-secrets-2.7.0
|
||||||
|
app.kubernetes.io/instance: sealed-secrets
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/version: v0.19.1
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resourceNames:
|
||||||
|
- sealed-secrets-key
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
---
|
||||||
|
# Source: sealed-secrets/templates/role.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: sealed-secrets-service-proxier
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: sealed-secrets
|
||||||
|
helm.sh/chart: sealed-secrets-2.7.0
|
||||||
|
app.kubernetes.io/instance: sealed-secrets
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/version: v0.19.1
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resourceNames:
|
||||||
|
- sealed-secrets
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resourceNames:
|
||||||
|
- 'http:sealed-secrets:'
|
||||||
|
- 'http:sealed-secrets:http'
|
||||||
|
- sealed-secrets
|
||||||
|
resources:
|
||||||
|
- services/proxy
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
# Source: sealed-secrets/templates/role-binding.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: sealed-secrets-key-admin
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: sealed-secrets
|
||||||
|
helm.sh/chart: sealed-secrets-2.7.0
|
||||||
|
app.kubernetes.io/instance: sealed-secrets
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/version: v0.19.1
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: sealed-secrets-key-admin
|
||||||
|
subjects:
|
||||||
|
- apiGroup: ""
|
||||||
|
kind: ServiceAccount
|
||||||
|
name: sealed-secrets
|
||||||
|
namespace: kube-system
|
||||||
|
---
|
||||||
|
# Source: sealed-secrets/templates/role-binding.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: sealed-secrets-service-proxier
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: sealed-secrets
|
||||||
|
helm.sh/chart: sealed-secrets-2.7.0
|
||||||
|
app.kubernetes.io/instance: sealed-secrets
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/version: v0.19.1
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: sealed-secrets-service-proxier
|
||||||
|
subjects:
|
||||||
|
- apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Group
|
||||||
|
name: system:authenticated
|
||||||
|
---
|
||||||
|
# Source: sealed-secrets/templates/service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: sealed-secrets
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: sealed-secrets
|
||||||
|
helm.sh/chart: sealed-secrets-2.7.0
|
||||||
|
app.kubernetes.io/instance: sealed-secrets
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/version: v0.19.1
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
port: 8080
|
||||||
|
targetPort: http
|
||||||
|
nodePort: null
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: sealed-secrets
|
||||||
|
app.kubernetes.io/instance: sealed-secrets
|
||||||
|
---
|
||||||
|
# Source: sealed-secrets/templates/deployment.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: sealed-secrets
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: sealed-secrets
|
||||||
|
helm.sh/chart: sealed-secrets-2.7.0
|
||||||
|
app.kubernetes.io/instance: sealed-secrets
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/version: v0.19.1
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: sealed-secrets
|
||||||
|
app.kubernetes.io/instance: sealed-secrets
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: sealed-secrets
|
||||||
|
app.kubernetes.io/instance: sealed-secrets
|
||||||
|
spec:
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 65534
|
||||||
|
serviceAccountName: sealed-secrets
|
||||||
|
containers:
|
||||||
|
- name: controller
|
||||||
|
command:
|
||||||
|
- controller
|
||||||
|
args:
|
||||||
|
- --update-status
|
||||||
|
- --key-prefix
|
||||||
|
- "sealed-secrets-key"
|
||||||
|
image: docker.io/bitnami/sealed-secrets-controller:v0.19.1
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
name: http
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 3
|
||||||
|
initialDelaySeconds: 0
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 1
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: http
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 3
|
||||||
|
initialDelaySeconds: 0
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 1
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: http
|
||||||
|
resources:
|
||||||
|
limits: {}
|
||||||
|
requests: {}
|
||||||
|
securityContext:
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1001
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /tmp
|
||||||
|
name: tmp
|
||||||
|
volumes:
|
||||||
|
- name: tmp
|
||||||
|
emptyDir: {}
|
||||||
Loading…
x
Reference in New Issue
Block a user