FLUXCD Setup 2 - SOPS Setup

Use SOPS with age :

Install age before if needed :

brew install age

Then create the decryption secret (save the key in a vault ):

cat age.agekey |
kubectl create secret generic sops-age \
--namespace=flux-system \
--from-file=age.agekey=/dev/stdin

Create .sops.yaml at the root or current directory

• .sops.yaml

creation_rules:
  - encrypted_regex: '^(data|stringData)$'
    age: age14xt22jc4d8p4t5sc7k0fnsy7fuxcgy464rrgkfzt2z2mmmzy835qpkckhd

Generate yaml manifest for secrets

Example for toolserafr certificate

• Generate the non encrypted yaml manifest

kubectl create secret tls toolserafr-certificate --dry-run=client -o yaml \
--cert=toolserafr_cloudflare_origin.crt  \
--key=toolserafr_cloudflare_origin.key \
| tee sops-tls-toolserafr.yaml

• Then encrypt the file with sops

sops -e  sops-tls-toolserafr.yaml | tee sops-tls-toolserafr-encrypted.yaml

• You can now safely commit this encrypted file in your repo

Setup decryption key in for Kustomization

You need to tell where and which key to use for decryption. To do that, you add the values to your kustomization :

decryption:  
  provider: sops  
  secretRef:  
    name: sops-age

The full example will look like this :

apiVersion: kustomize.toolkit.fluxcd.io/v1beta2  
kind: Kustomization  
metadata:  
  name: infrastructure  
  namespace: flux-system  
spec:  
  interval: 10m0s  
  sourceRef:  
    kind: GitRepository  
    name: flux-system  
  path: ./infrastructure/dev-talos-cluster  
  prune: true  
  wait: true  
  decryption:  
    provider: sops  
    secretRef:  
      name: sops-age