actions/fluxcd-flux2
3
0
Fork 0
mirror of https://github.com/fluxcd/flux2.git synced 2026-02-15 20:21:47 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge pull request #709 from SomtochiAma/gcp-kms-docs

Browse source 
Add GCP docs for Mozilla SOPS
This commit is contained in:
Hidde Beydals 2021-01-15 12:21:59 +01:00 committed by GitHub
commit 36bafa23df
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
docs/guides/mozilla-sops.md
View file

@ -104,13 +104,15 @@ flux create kustomization my-secrets \
Note that the `sops-gpg` can contain more than one key, sops will try to decrypt the Note that the `sops-gpg` can contain more than one key, sops will try to decrypt the
secrets by iterating over all the private keys until it finds one that works. secrets by iterating over all the private keys until it finds one that works.
### AWS/Azure/GCP ### Using various cloud providers
When using AWS/GCP KMS, you'll have to bind an IAM Role with access to the KMS When using AWS/GCP KMS, you'll have to bind an IAM Role with access to the KMS
keys to the `default` service account of the `flux-system` namespace for keys to the `default` service account of the `flux-system` namespace for
kustomize-controller to be able to fetch keys from KMS. kustomize-controller to be able to fetch keys from KMS.
AWS IAM Role example: #### AWS
IAM Role example:
```json ```json
{ {
@ -131,10 +133,27 @@ AWS IAM Role example:
} }
``` ```
#### Azure
When using Azure Key Vault you need to authenticate the kustomize controller either by passing When using Azure Key Vault you need to authenticate the kustomize controller either by passing
[Service Principal credentials as environment variables](https://github.com/mozilla/sops#encrypting-using-azure-key-vault) [Service Principal credentials as environment variables](https://github.com/mozilla/sops#encrypting-using-azure-key-vault)
or with [add-pod-identity](https://github.com/Azure/aad-pod-identity). or with [add-pod-identity](https://github.com/Azure/aad-pod-identity).
#### Google Cloud
Please ensure that the GKE cluster has Workload Identity enabled.
1. Create a service account with the role `Cloud KMS CryptoKey Encrypter/Decrypter`.
2. Create an IAM policy binding between the GCP service account to the `default` service account of the `flux-system`.
3. Annotate the `default` service account in the `flux-system` with the GCP service account.
```sh
kubectl annotate serviceaccount \
--namespace flux-system \
default \
iam.gke.io/gcp-service-account=<name-of-serviceaccount>@project-id.iam.gserviceaccount.com
```
## GitOps workflow ## GitOps workflow
A cluster admin should create the Kubernetes secret with the PGP keys on each cluster and A cluster admin should create the Kubernetes secret with the PGP keys on each cluster and