conf.yaml
:
---
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
- secrets
providers:
- kms:
name: sops
endpoint: unix:///var/lib/sops/sops.sock
cachesize: 100
timeout: 3s
- identity: {}
Start kube-apiserver with --encryption-provider-config /path/to/conf.yaml
Launch sops keyservice (maybe need to create /var/lib/sops
inside Docker VM
first; see later to enter Docker VM):
GOOS=linux GOARCH=amd64 go build go.mozilla.org/sops/v3/cmd/sops && \
docker-run-cwd \
-v "/var/lib/sops:/inside-k8s" \
-v "./sops-conf/sops.yaml:/etc/sops/conf.yaml:ro" \
-v "./sops-conf/gnupg:/root/.gnupg" \
gpg \
./sops --config /etc/sops/conf.yaml keyservice-k8s --verbose --path /inside-k8s/sops.sock
For everything below, create missing folders if needed.
First, go in the Docker for Mac VM:
docker run -it --rm --privileged --pid=host alpine:edge nsenter -t 1 -m -u -n -i sh
Create the EncryptionConfiguration
above at /run/config/k8s-encryption/encryption-config.yaml
.
Then edit /etc/kubernetes/manifests/kube-apiserver.yaml
.
-
Add the following in
spec.containers[0].command
:
- --encryption-provider-config=/run/config/k8s-encryption/encryption-config.yaml
-
Add the following volume mount paths:
- mountPath: /var/lib/sops name: sops readOnly: true - mountPath: /run/config/k8s-encryption name: k8s-encryption readOnly: true
-
Add the following volumes:
- hostPath: path: /var/lib/sops type: Directory name: sops - hostPath: path: /run/config/k8s-encryption type: Directory name: k8s-encryption