I am in the learning phase of kubernetes and able to set up deployments, services etc. However I have got stuck on how to manage secrets.

Context

1. I am using GKE for Kubernetes cluster

2. I am using helm charts for managing all deployment operations

3. I have created a google service account that has access to say google cloud storage.

My application uses the helm to create deployments and services, however, how do I manage the google service account creds I have created in an automated way like

1. I do not want to create the secrets manually like this - kubectl create secret generic pubsub-key --from-file=key.json=PATH-TO-KEY-FILE.json , I want to do it through helm because say tomorrow if I move to another k8s cluster then I have do it manually again

2. Is there anyway to push my helm charts to repos without concerning of exposing my secrets as plain objects.

Apart from this, any other guidelines and best practices would be really helpful.

CodePudding user response：

I do not want to create the secrets manually like this - kubectl create secret generic pubsub-key --from-file=key.json=PATH-TO-KEY-FILE.json , I want to do it through helm because say tomorrow if I move to another k8s cluster then I have do it manually again

You can create the secret template to helm which will create the secret for you, at run time of helm time.

You helm will find the service account.json and create the secret based on that.

For example service-account.yaml

{{- $all := . -}}
{{ range $name, $secret := .Values.serviceAccountSecrets }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $name }}
  labels:
    app: {{ $name }}
    chart: {{ template "atlantis.chart" $all }}
    component: service-account-secret
    heritage: {{ $all.Release.Service }}
    release: {{ $all.Release.Name }}
data:
  service-account.json: {{ $secret }}
---
{{ end }}

values.yaml

serviceAccountSecrets:
  # credentials: <json file as base64 encoded string>
  # credentials-staging: <json file as base64 encoded string>

Or else you can use this GCP service account controller which creates the Serviceaccount and the secret for you.

https://github.com/kiwigrid/gcp-serviceaccount-controller

Is there anyway to push my helm charts to repos without concerning of exposing my secrets as plain objects.

For committing issues you can use the .helmignore file.

Read more at : https://helm.sh/docs/chart_template_guide/helm_ignore_file/

So inside the GIT, you have to commit only values.yaml not values-dev.yaml, values-stag.yaml

CodePudding user response：

Secret management is a complex topic, and there are many approaches possible, like using the Secret Manager in GCP.

However, for the specific problem of managing Google Service Account credentials in GKE, the recommended approach is to use Workload Identity.

This way, you don't even have to create keys. You have to activate Workload Identity and create mappings for the Kubernetes service account to the GCP service account. Once this is set up, you can just set the Deployment's Kubernetes service account to that account using Workload Identity.