parent
9d74fa3513
commit
f629ee1ae6
|
|
@ -14,7 +14,7 @@ Helmfile integrates [vals]() to import configuration parameters from following b
|
|||
- Vault
|
||||
- SOPS
|
||||
|
||||
See [Vals "Suported Backends"](https://github.com/variantdev/vals#suported-backends) for the full list of available backends.
|
||||
See [Vals "Suported Backends"](https://github.com/helmfile/vals#suported-backends) for the full list of available backends.
|
||||
|
||||
This feature was implemented in https://github.com/roboll/helmfile/pull/906.
|
||||
If you're curious how it's designed and how it works, please consult the pull request.
|
||||
|
|
|
|||
|
|
@ -1,32 +1,32 @@
|
|||
# Secrets
|
||||
# Secrets
|
||||
|
||||
helmfile can handle secrets using [helm-secrets](https://github.com/jkroepke/helm-secrets) plugin or using remote secrets storage
|
||||
(everything that package [vals](https://github.com/variantdev/vals) can handle vault, AWS SSM etc)
|
||||
This section will describe the second use case.
|
||||
helmfile can handle secrets using [helm-secrets](https://github.com/jkroepke/helm-secrets) plugin or using remote secrets storage
|
||||
(everything that package [vals](https://github.com/helmfile/vals) can handle vault, AWS SSM etc)
|
||||
This section will describe the second use case.
|
||||
|
||||
# Remote secrets
|
||||
# Remote secrets
|
||||
|
||||
This paragraph will describe how to use remote secrets storage (vault, SSM etc) in helmfile
|
||||
This paragraph will describe how to use remote secrets storage (vault, SSM etc) in helmfile
|
||||
|
||||
## Fetching single key
|
||||
|
||||
To fetch single key from remote secret storage you can use `fetchSecretValue` template function example below
|
||||
|
||||
```yaml
|
||||
# helmfile.yaml
|
||||
```yaml
|
||||
# helmfile.yaml
|
||||
|
||||
repositories:
|
||||
- name: stable
|
||||
url: https://kubernetes-charts.storage.googleapis.com
|
||||
repositories:
|
||||
- name: stable
|
||||
url: https://kubernetes-charts.storage.googleapis.com
|
||||
|
||||
environments:
|
||||
default:
|
||||
environments:
|
||||
default:
|
||||
values:
|
||||
- service:
|
||||
password: ref+vault://svc/#pass
|
||||
login: ref+vault://svc/#login
|
||||
releases:
|
||||
- name: service
|
||||
- name: service
|
||||
namespace: default
|
||||
labels:
|
||||
cluster: services
|
||||
|
|
@ -37,10 +37,10 @@ releases:
|
|||
- service:
|
||||
login: {{ .Values.service.login | fetchSecretValue }} # this will resolve ref+vault://svc/#pass and fetch secret from vault
|
||||
password: {{ .Values.service.password | fetchSecretValue | quote }}
|
||||
# - values/service.yaml.gotmpl # alternatively
|
||||
# - values/service.yaml.gotmpl # alternatively
|
||||
```
|
||||
## Fetching multiple keys
|
||||
Alternatively you can use `expandSecretRefs` to fetch a map of secrets
|
||||
Alternatively you can use `expandSecretRefs` to fetch a map of secrets
|
||||
```yaml
|
||||
# values/service.yaml.gotmpl
|
||||
service:
|
||||
|
|
@ -53,6 +53,6 @@ This will produce
|
|||
service:
|
||||
login: svc-login # fetched from vault
|
||||
password: pass
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -114,14 +114,14 @@ The `required` function returns the second argument as-is only if it is not empt
|
|||
```
|
||||
|
||||
#### `fetchSecretValue`
|
||||
The `fetchSecretValue` function parses the argument as a [vals](https://github.com/variantdev/vals) ref URL, retrieves and returns the remote secret value referred by the URL. In case it failed to access the remote secret backend for whatever reason or the URL was invalid, the template rendering will fail with an error message.
|
||||
The `fetchSecretValue` function parses the argument as a [vals](https://github.com/helmfile/vals) ref URL, retrieves and returns the remote secret value referred by the URL. In case it failed to access the remote secret backend for whatever reason or the URL was invalid, the template rendering will fail with an error message.
|
||||
|
||||
```yaml
|
||||
{{ $fetchSecretValue := fetchSecretValue "secret/path" }}
|
||||
```
|
||||
|
||||
#### `expandSecretRefs`
|
||||
The `expandSecretRefs` function takes an object as the argument and expands every [vals](https://github.com/variantdev/vals) secret reference URL embedded in the object's values. See ["Remote Secrets" page in our documentation](./remote-secrets.md) for more information.
|
||||
The `expandSecretRefs` function takes an object as the argument and expands every [vals](https://github.com/helmfile/vals) secret reference URL embedded in the object's values. See ["Remote Secrets" page in our documentation](./remote-secrets.md) for more information.
|
||||
|
||||
```yaml
|
||||
{{ $expandSecretRefs := $value | expandSecretRefs }}
|
||||
|
|
|
|||
2
go.mod
2
go.mod
|
|
@ -14,6 +14,7 @@ require (
|
|||
github.com/gosuri/uitable v0.0.4
|
||||
github.com/hashicorp/go-getter v1.7.0
|
||||
github.com/hashicorp/go-version v1.6.0
|
||||
github.com/helmfile/vals v0.22.0
|
||||
github.com/imdario/mergo v0.3.13
|
||||
github.com/spf13/cobra v1.6.1
|
||||
github.com/spf13/pflag v1.0.5
|
||||
|
|
@ -21,7 +22,6 @@ require (
|
|||
github.com/tatsushid/go-prettytable v0.0.0-20141013043238-ed2d14c29939
|
||||
github.com/variantdev/chartify v0.13.0
|
||||
github.com/variantdev/dag v1.1.0
|
||||
github.com/variantdev/vals v0.21.0
|
||||
go.szostok.io/version v1.1.0
|
||||
go.uber.org/multierr v1.9.0
|
||||
go.uber.org/zap v1.24.0
|
||||
|
|
|
|||
4
go.sum
4
go.sum
|
|
@ -640,6 +640,8 @@ github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKe
|
|||
github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
|
||||
github.com/helmfile/go-yaml v0.0.0-20230206025945-259d2ed450ae h1:7A1UNvxMfzQWGTEKKfj3k+m4Vjfd+PZnZkCs9iL7o/U=
|
||||
github.com/helmfile/go-yaml v0.0.0-20230206025945-259d2ed450ae/go.mod h1:JubOolP3gh0HpiBc4BLRD4YmjEjHAmIIB2aaXKkTfoE=
|
||||
github.com/helmfile/vals v0.22.0 h1:UZN3miHw/12GxyJyubOIFFzVwQQw0IR0hPZS1Syn2VI=
|
||||
github.com/helmfile/vals v0.22.0/go.mod h1:CC3DuP0Rv3IexXfTVMwwqBxNTcA574jpmEDa5A72Kto=
|
||||
github.com/hokaccha/go-prettyjson v0.0.0-20190818114111-108c894c2c0e/go.mod h1:pFlLw2CfqZiIBOx6BuCeRLCrfxBJipTY0nIOF/VbGcI=
|
||||
github.com/hokaccha/go-prettyjson v0.0.0-20211117102719-0474bc63780f h1:7LYC+Yfkj3CTRcShK0KOL/w6iTiKyqqBA9a41Wnggw8=
|
||||
github.com/hokaccha/go-prettyjson v0.0.0-20211117102719-0474bc63780f/go.mod h1:pFlLw2CfqZiIBOx6BuCeRLCrfxBJipTY0nIOF/VbGcI=
|
||||
|
|
@ -922,8 +924,6 @@ github.com/variantdev/chartify v0.13.0 h1:MvRIx+O68L6PT0gGZTcUuOfq0Dndw2PnRNVyEq
|
|||
github.com/variantdev/chartify v0.13.0/go.mod h1:3IRW30hc1mAUyQae5TpNDhZmj8JBJ0trwPPWbNmtcLQ=
|
||||
github.com/variantdev/dag v1.1.0 h1:xodYlSng33KWGvIGMpKUyLcIZRXKiNUx612mZJqYrDg=
|
||||
github.com/variantdev/dag v1.1.0/go.mod h1:pH1TQsNSLj2uxMo9NNl9zdGy01Wtn+/2MT96BrKmVyE=
|
||||
github.com/variantdev/vals v0.21.0 h1:p0fMOqJxNufqwpx0BQgcCRntWW630I4i+/CKeZri2xA=
|
||||
github.com/variantdev/vals v0.21.0/go.mod h1:RPcySU5Qt4B9VJFPzEFmx4Ulr5yZSGXAsAk86k7ww+8=
|
||||
github.com/xlab/treeprint v1.1.0 h1:G/1DjNkPpfZCFt9CSh6b5/nY4VimlbHF3Rh4obvtzDk=
|
||||
github.com/xlab/treeprint v1.1.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
|
||||
github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ import (
|
|||
"sync"
|
||||
"text/tabwriter"
|
||||
|
||||
"github.com/variantdev/vals"
|
||||
"github.com/helmfile/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/argparser"
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ import (
|
|||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/variantdev/vals"
|
||||
"github.com/helmfile/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/exectest"
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ import (
|
|||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/variantdev/vals"
|
||||
"github.com/helmfile/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/exectest"
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ import (
|
|||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/variantdev/vals"
|
||||
"github.com/helmfile/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/exectest"
|
||||
|
|
|
|||
|
|
@ -5,8 +5,8 @@ import (
|
|||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/helmfile/vals"
|
||||
"github.com/stretchr/testify/require"
|
||||
"github.com/variantdev/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/exectest"
|
||||
|
|
|
|||
|
|
@ -8,8 +8,8 @@ import (
|
|||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/helmfile/vals"
|
||||
"github.com/stretchr/testify/require"
|
||||
"github.com/variantdev/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/exectest"
|
||||
|
|
|
|||
|
|
@ -6,8 +6,8 @@ import (
|
|||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/helmfile/vals"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/variantdev/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
ffs "github.com/helmfile/helmfile/pkg/filesystem"
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ import (
|
|||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/variantdev/vals"
|
||||
"github.com/helmfile/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/exectest"
|
||||
|
|
|
|||
|
|
@ -8,8 +8,8 @@ import (
|
|||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/helmfile/vals"
|
||||
"github.com/stretchr/testify/require"
|
||||
"github.com/variantdev/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/exectest"
|
||||
|
|
|
|||
|
|
@ -15,8 +15,8 @@ import (
|
|||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/helmfile/vals"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/variantdev/vals"
|
||||
"go.uber.org/zap"
|
||||
"helm.sh/helm/v3/pkg/chart"
|
||||
|
||||
|
|
|
|||
|
|
@ -6,8 +6,8 @@ import (
|
|||
"fmt"
|
||||
"path/filepath"
|
||||
|
||||
"github.com/helmfile/vals"
|
||||
"github.com/imdario/mergo"
|
||||
"github.com/variantdev/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/environment"
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ import (
|
|||
"sync"
|
||||
"testing"
|
||||
|
||||
"github.com/variantdev/vals"
|
||||
"github.com/helmfile/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/exectest"
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ import (
|
|||
"sync"
|
||||
"testing"
|
||||
|
||||
"github.com/variantdev/vals"
|
||||
"github.com/helmfile/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/exectest"
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ import (
|
|||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/variantdev/vals"
|
||||
"github.com/helmfile/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/exectest"
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ import (
|
|||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/variantdev/vals"
|
||||
"github.com/helmfile/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/exectest"
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ package plugins
|
|||
import (
|
||||
"sync"
|
||||
|
||||
"github.com/variantdev/vals"
|
||||
"github.com/helmfile/vals"
|
||||
)
|
||||
|
||||
const (
|
||||
|
|
|
|||
|
|
@ -5,8 +5,8 @@ import (
|
|||
"fmt"
|
||||
"io"
|
||||
|
||||
"github.com/helmfile/vals"
|
||||
"github.com/imdario/mergo"
|
||||
"github.com/variantdev/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/environment"
|
||||
|
|
|
|||
|
|
@ -17,10 +17,10 @@ import (
|
|||
"sync"
|
||||
"text/template"
|
||||
|
||||
"github.com/helmfile/vals"
|
||||
"github.com/imdario/mergo"
|
||||
"github.com/tatsushid/go-prettytable"
|
||||
"github.com/variantdev/chartify"
|
||||
"github.com/variantdev/vals"
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/environment"
|
||||
|
|
|
|||
|
|
@ -9,8 +9,8 @@ import (
|
|||
"testing"
|
||||
|
||||
"github.com/Masterminds/semver/v3"
|
||||
"github.com/helmfile/vals"
|
||||
"github.com/stretchr/testify/require"
|
||||
"github.com/variantdev/vals"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/environment"
|
||||
"github.com/helmfile/helmfile/pkg/exectest"
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ import (
|
|||
"fmt"
|
||||
"sync"
|
||||
|
||||
"github.com/variantdev/vals"
|
||||
"github.com/helmfile/vals"
|
||||
|
||||
"github.com/helmfile/helmfile/pkg/plugins"
|
||||
)
|
||||
|
|
|
|||
Loading…
Reference in New Issue