conf.yaml:
---
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
- secrets
providers:
- kms:
name: sops
endpoint: unix:///var/lib/sops/sops.sock
cachesize: 100
timeout: 3s
- identity: {}Start kube-apiserver with --encryption-provider-config /path/to/conf.yaml
Launch sops keyservice (maybe need to create /var/lib/sops inside Docker VM
first; see later to enter Docker VM):
GOOS=linux GOARCH=amd64 go build go.mozilla.org/sops/v3/cmd/sops && \
docker-run-cwd \
-v "/var/lib/sops:/inside-k8s" \
-v "./sops-conf/sops.yaml:/etc/sops/conf.yaml:ro" \
-v "./sops-conf/gnupg:/root/.gnupg" \
gpg \
./sops --config /etc/sops/conf.yaml keyservice-k8s --verbose --path /inside-k8s/sops.sockFor everything below, create missing folders if needed.
First, go in the Docker for Mac VM:
docker run -it --rm --privileged --pid=host alpine:edge nsenter -t 1 -m -u -n -i shCreate the EncryptionConfiguration above at /run/config/k8s-encryption/encryption-config.yaml.
Then edit /etc/kubernetes/manifests/kube-apiserver.yaml.
-
Add the following in
spec.containers[0].command:
- --encryption-provider-config=/run/config/k8s-encryption/encryption-config.yaml
-
Add the following volume mount paths:
- mountPath: /var/lib/sops
name: sops
readOnly: true
- mountPath: /run/config/k8s-encryption
name: k8s-encryption
readOnly: true
-
Add the following volumes:
- hostPath:
path: /var/lib/sops
type: Directory
name: sops
- hostPath:
path: /run/config/k8s-encryption
type: Directory
name: k8s-encryption
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent