A tool for importing secrets from a pre-existing secrets management systems (e.g. Vault, Secrets Manager) into a SealedSecret :shushing_face:

  • By Elad Leev
  • Last update: Jan 18, 2023
  • Comments: 1

kubeseal-convert

GitHub Workflow Status Go Report Card

The missing part of Sealed Secrets. 🔐

Motivation

kubeseal-convert aims to reduce the friction of importing secrets from a pre-existing secret management systems (e.g. Vault, AWS Secrets Manager, etc) into a SealedSecret.
Instaed of:

  1. Going into AWS Secret Manager
  2. Retrieve the secret who needs to be migrated
  3. Create a "normal" k8s secret
  4. Fill out the values on the secret
  5. Run kubeseal

Just run kubeseal-convert with the secret path.

Table of Contents

Flags & Options

Same as the kubeseal command, kubeseal-convert is un-opinionated. It won't commit the secret to Git, apply it to the cluster, or save it on a specific path.
The SealedSecret will be printed to STDOUT. You can run it as is, as part of CI, or as part of a Job.

./kubeseal-convert <SECRETS_STORE> <PATH> --namespace <NS_NAME> --name <SECRET_NAME>

Flags

Name Description Require Type
-n, --name The Sealed Secret name. V string
--namespace The Sealed Secret namespace. If not specified, taken from k8s context. string
-a, --annotations Sets k8s annotations. KV pairs, comma separated. []string
-l, --labels Sets k8s lables. KV pairs, comma separated. []string
-h, --help Display help. none
-v, --version Display version. none

Supported SM Systems

✅ AWS Secrets Manager
✅ Hashicorp Vault
✅ Azure Key Vault - Contributed by @kroonprins
❓ Google Secrets Manager

AWS Secrets Manager

The AWS client rely on AWS local configuration variables - config file, environment variables, etc.

Hashicorp Vault

In order to work with the Vault provider, two environment variables needs to be set - VAULT_TOKEN and VAULT_ADDR.
Currently, only kv-v2 is supported.

Azure Key Vault

The <SECRETS_STORE> should contain the vault name from the vault full uri https://<SECRETS_STORE>.vault.azure.net. Authentication to the vault happens either via environment variables, managed identity, or via the az cli (az login).

Build from source

Prerequisites

  • Go version 1.19+
  • make command installed
  • kubeseal command installed, and a valid communication to the sealed secrets controller.

Building Steps

  1. Clone this repository
git clone https://github.com/EladLeev/kubeseal-convert && cd kubeseal-convert
  1. Build using Makefile
make build
  1. [optional] Set up local env for testing
make init-dev
  1. [optional] Run the example

Examples

./kubeseal-convert sm MyTestSecret --namespace test-ns --name test-secret --annotations converted-by=kubeseal-convert,env=dev --labels test=abc > secret.yaml

or

./kubeseal-convert vlt "mydomain/data/MyTestSecret" --namespace test-ns --name test-secret --annotations converted-by=kubeseal-convert,src=vault --labels test=abc > secret.yaml

This will:

  1. Retrieve a secret called MyTestSecret from AWS Secrets Manager / Hashicorp Vault
  2. Create it on test-ns namespace
  3. Call it test-secret
  4. Add few annotations and labels
  5. Save it as secret.yaml to be push to the repo safely

Contributing

Please read CONTRIBUTING.md for details of submitting a pull requests.

License

This project is licensed under the Apache License - see the LICENSE file for details.

Download

kubeseal-convert.zip

Comments(1)

  • 1

    Bump golang.org/x/net from 0.4.0 to 0.7.0

    Bumps golang.org/x/net from 0.4.0 to 0.7.0.

    Commits
    • 8e2b117 http2/hpack: avoid quadratic complexity in hpack decoding
    • 547e7ed http2: avoid referencing ResponseWrite.Write parameter after returning
    • 39940ad html: parse comments per HTML spec
    • 87ce33e go.mod: update golang.org/x dependencies
    • 415cb6d all: fix some comments
    • 7e3c19c all: correct typos in comments
    • 296f09a http2: case insensitive handling for 100-continue
    • f8411da nettest: fix tests on dragonfly and js/wasm
    • 8e0e7d8 go.mod: update golang.org/x dependencies
    • 7805fdc http2: rewrite inbound flow control tracking
    • Additional commits viewable in compare view

    Dependabot compatibility score

    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

    Dependabot commands and options

    You can trigger Dependabot actions by commenting on this PR:

    • @dependabot rebase will rebase this PR
    • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • @dependabot merge will merge this PR after your CI passes on it
    • @dependabot squash and merge will squash and merge this PR after your CI passes on it
    • @dependabot cancel merge will cancel a previously requested merge and block automerging
    • @dependabot reopen will reopen this PR if it is closed
    • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
    • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
    • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
    • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
    • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

    You can disable automated security fix PRs for this repo from the Security Alerts page.

Popular Tag

Related