repository·main·Indexed 24 days ago
https://github.com/jkroepke/helm-secretsA Helm plugin for decrypting encrypted Helm value files on the fly. It supports sops for Git-stored secrets and vals for referencing cloud-native secret managers like AWS SSM, Azure KeyVault, and HashiCorp Vault. Features include a protocol handler (secrets://) for ArgoCD integration, a plugin command wrapper, and the ability to evaluate secret references directly inside Helm templates using the --evaluate-templates flag.
The helm-secrets plugin supports multiple backends for managing and decrypting secrets. Currently, the supported backends are:
When using private key encryption (GPG or age), the argocd-repo-server must have access to the private keys to decrypt files.
There are three primary patterns for providing keys:
.asc or .txt keys as a volume to the argocd-repo-server. Use the secrets+gpg-import:// or secrets+age-import:// schemes.secrets+gpg-import-kubernetes:// or secrets+age-import-kubernetes:// schemes to reference a secret in a specific namespace.HELM_SECRETS_LOAD_GPG_KEYS (for GPG) or SOPS_AGE_KEY_FILE (for age) to point to the key file path.You can use helm-secrets as a Helm downloader plugin to decrypt value files directly via the -f flag using the secrets:// protocol. This allows you to reference local files or remote files (e.g., from Git) that need decryption before being processed by Helm.
Supported URI formats include:
secrets://<uri to file>secrets://git+<git-url>@<path>?ref=<branch/tag>helm-secrets by downloading the tarball and extracting it directly into your Helm plugins directory. This method works for both Helm 2 and Helm 3.To fetch secrets dynamically from cloud services (AWS, Azure, GCP, etc.), helm-secrets uses the vals backend.
helm-secrets version 3.9.x or higher (version 4.1+ is required for literal values).vals binary must be installed.vals binary from the official GitHub releases.PATH (e.g., /usr/local/bin/).HELM_SECRETS_VALS_PATH environment variable.The helm secrets command acts as a wrapper for standard Helm commands (e.g., install, upgrade, rollback, diff). When you use the wrapper, any files passed via the -f or --values flags that are encrypted will be decrypted on-the-fly before the Helm command executes.
Key Behaviors:
.dec by default) are automatically removed after the Helm command finishes, even if the command fails.secrets.yaml.dec) already exists and is newer than the encrypted secrets.yaml, the wrapper will use the existing .dec file instead of re-decrypting.helm-diff by calling helm secrets diff ....AWS_PROFILE=sandbox helm secrets upgrade \
helloworld \
stable/java-app \
--install \
--timeout 600 \
--wait \
--kube-context=sandbox \
--namespace=projectx \
-f helm_vars/projectx/sandbox/us-east-1/java-app/helloworld/secrets.yaml \
-f helm_vars/projectx/sandbox/us-east-1/java-app/helloworld/values.yamlYou can use the helm secrets command to wrap the entire helm execution. This method is useful for general usage but can be slower when dealing with multiple value files because it wraps the whole command.
To use it, replace helm with helm secrets in your standard Helm commands.
helm secrets upgrade name . -f secrets.yamlYou can rely on existing environment variables or pre-seeded agents on the argocd-repo-server.
HELM_SECRETS_LOAD_GPG_KEYS to provide the path to the GPG key, or ensure a GPG agent is running.SOPS_AGE_KEY_FILE to provide the path to the age key file.In your Application spec, you simply reference the encrypted file using the standard secrets:// prefix:
valueFiles:
- secrets://secrets.yamlTo protect against directory traversal attacks (e.g., using ../ sequences to access files outside the intended directory), enable path traversal restrictions. Setting this variable will prevent access to arbitrary files and directories on the filesystem.
HELM_SECRETS_VALUES_ALLOW_PATH_TRAVERSAL=falseBy using the helm-git plugin, helm-secrets can fetch secrets from Git repositories. Use the secrets://git+https:// prefix followed by the repository URL and optional parameters for path, reference, or sparse checkout.
helm template -f secrets://git+https://<provider.com>/<path/to/repo>[@path/to/charts][?[ref=git-ref][&sparse=0][&depupdate=0][&package=0]]You can use helm-secrets in Argo CD by utilizing the downloader plugin syntax within an Argo CD Application resource. This allows Argo CD to decrypt encrypted value files during the Helm template generation process.
Important Constraints:
age encryption over gpg if possible.Prerequisites:
2.3.0+, 2.2.6+, or 2.1.11+ (Note: 2.1.9, 2.1.10, 2.2.4, and 2.2.5 are incompatible).helm-secrets version 3.9.x or higher.age encryption: helm-secrets 3.10.0+ and sops 3.7.0+.apiVersion: argoproj.io/v1alpha1
kind: Application
spec:
source:
helm:
valueFiles:
- secrets+gpg-import:///helm-secrets-private-keys/key.asc?secrets.yaml
fileParameters:
- name: config
path: secrets://secrets.yamlIf curl or wget is available on your system, helm-secrets can fetch value files from remote HTTP/HTTPS locations using the secrets:// protocol prefix.
helm template -f secrets://https://raw.githubusercontent.com/jkroepke/helm-secrets/main/examples/sops/secrets.yaml