bitnami / bitnami/sealed-secrets

Sealed Secrets plugin for Helm

Open
#1,413 2 comments 2 reactions 0 assignees View on GitHub
backlog enhancement
Dominant language
Go
Stars
9.3k
Forks
777
Avg merge
1d 13h
Merged PRs (30d)
30

Description

**Which component**:

N/A

**Is your feature request related to a problem? Please describe.**

When I use Helm charts to deploy (or rendering the templates for later deploying) certain apps, I need to perform complementary steps to manage the secrets shipped on these charts with Sealed Secrets.

**Describe the solution you'd like**

I'd like the Sealed Secrets team to develop some plugin for Helm that extends the `helm install`, `helm template` & `helm upgrade` commands with new flags for configuring how to encrypt secrets shipped on a chart with Sealed Secrets (`--sealed-secrets-controller-name`, `--sealed-secrets-controller-namespace`, `sealed-secrets-cert`, etc.).

This plugin should allow `helm` to automatically encrypt secrets using Kubeseal libraries & introducing the steps below in the mentioned Helm commands workflows:

- Detect available K8s secrets within the K8s manifests after rendering templates.
- (optional) download cert / public key to use for encryption.
- Encrypt K8s secrets as Sealed Secrets and replace K8s secrets with them from the list of rendered manifests.

**Describe alternatives you've considered**

There are two main approaches to deal with this without the requested plugin:

- Render manifests (`helm template ...`) -> Manually encrypt resulting secrets with Kubeseal -> Manually deploy manifests replacing secrets manifests with corresponding sealed-secrets ones.
- Manually create required secrets -> Manually encrypt them with Kubeseal and create them with Kubectl - > Deploy chart configuring it to use the previously created secrets (only possible if charts support "existingSecret" or equivalent parameters)

**Additional context**

N/A

Contributor guide

Open the contributing guide

Research direction

Begin by reviewing Helm's extension points and the kubeseal libraries, then trace the rendered-manifest workflow for helm install, helm template, and helm upgrade. Done means secrets are detected, optionally encrypted with the selected certificate or controller, and replaced with Sealed Secrets without requiring the manual workflow described.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.