opensource/flux2
1
0
Fork 0
mirror of https://github.com/fluxcd/flux2.git synced 2025-11-02 10:48:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add AWS IAM role example to SOPS docs

Browse Source 
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
This commit is contained in:
Stefan Prodan
2020-11-20 15:26:10 +02:00
parent 875aefc8dd
commit 59adef5bcc
1 changed files with 30 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
docs/guides/mozilla-sops.md
View File

@ -101,13 +101,36 @@ flux create kustomization my-secrets \
Note that the `sops-gpg` can contain more than one key, sops will try to decrypt the Note that the `sops-gpg` can contain more than one key, sops will try to decrypt the
secrets by iterating over all the private keys until it finds one that works. secrets by iterating over all the private keys until it finds one that works.
!!! hint KMS ### AWS/Azure/GCP
When using AWS/GCP KMS, you'll have to bind an IAM Role
with read access to the KMS keys to the `default` service account of the When using AWS/GCP KMS, you'll have to bind an IAM Role with access to the KMS
`flux-system` namespace for kustomize-controller to be able to fetch keys to the `default` service account of the `flux-system` namespace for
keys from KMS. When using Azure Key Vault you need to authenticate the kustomize controller either by passing kustomize-controller to be able to fetch keys from KMS.
[Service Principal credentials as environment variables](https://github.com/mozilla/sops#encrypting-using-azure-key-vault)
or with [add-pod-identity](https://github.com/Azure/aad-pod-identity). AWS IAM Role example:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Effect": "Allow",
"Resource": "arn:aws:kms:eu-west-1:XXXXX209540:key/4f581f5b-7f78-45e9-a543-83a7022e8105"
}
]
}
```
When using Azure Key Vault you need to authenticate the kustomize controller either by passing
[Service Principal credentials as environment variables](https://github.com/mozilla/sops#encrypting-using-azure-key-vault)
or with [add-pod-identity](https://github.com/Azure/aad-pod-identity).
## GitOps workflow ## GitOps workflow