Sekret is a CLI tool to encrypt and edit Kubernetes Secrets. Sekret makes management and deployment for Secret secure and simple.
- want version controlled Secret like other resources (e.g., deployments)
- want to commit encrypted Secret YAMLs
- want to edit encrypted Secret YAMLs easily
- want to apply decrypted Secret YAMLs easily
- Encrypt plain YAMLs
- Decrypt encrypted YAMLs
- Create new encrypted Secret YAMLs
- Edit encrypted Secret YAMLs as plain text
You can get Sekret with
go get github.com/nownabe/sekret
Also, you can download binaries from GitHub Releases.
curl -sSL -o /path/to/sekret https://github.com/nownabe/sekret/releases/download/v1.1.0/sekret_linux_amd64 chmod +x /path/to/sekret
sekret command is used following subcommands
sekret subcommand [options] filename
The environment variable
ENCRYPTION_KEY is used as the encryption key for all subcommands. Encryption keys must be 16 or 32 bytes.
EDITOR variable specifies the editor for
edit subcommands. Command options can also specify them.
Following commands encrypt
secret.yaml and then commit it on Git.
$ export ENCRYPTION_KEY=$(cat /dev/urandom | base64 | fold -32 | head -1) $ sekret enc secret.yaml > secret.yaml.enc $ git add secret.yaml.enc $ git commit
Easy to decrypt and apply Secrets.
$ sekret dec secret.yaml.enc | kubectl apply -f -
new subcommand creates a new encrypted Secret YAMLs.
$ export EDITOR=vim $ sekret new secret.yaml.enc
sekret new opens specified editor with the Secret template like following YAML.
apiVersion: v1 data: Key: Value kind: Secret metadata: creationTimestamp: null name: new-secret type: Opaque
data must be encoded as base64 in Kubernetes Secrets, but sekret encodes and decodes automatically on opening and saving them. So you can write YAML as completely plain text. If you want to edit as base64, use
Sekret validates before saving YAML, so it doesn't save YAML when invalid.
You can edit encrypted Secret YAML like plaintexts with
$ sekret edit secret.yaml.enc
sekret edit opens decrypted and base64 decoded YAML in the specified editor. When the editor is closed, it saves encrypted and base64 encoded YAML. Of course, it validates YAML before saving.
Sekret makes lifecycle of Sekret very simple and secure. It is effortless to manage and deploy Secret YAML.