KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #ai-agents #developer-tools #codex #claude-code #mcp #rust #deepseek-harness #typescript #ai-agent #cli

kustomize-age

★ 18 Open GitHub ↗

A kustomize plugin for using age encrypted files in Secrets

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

kustomize-age is a plugin for `kustomize` that allows the user to keep local
files encrypted with `age` that are decrypted before being used as `files`
inside a kubernetes `Secret`.

Unlike kustomize-sops it does not encrypt the whole `Secret` yaml file, but just
the files mentioned in the `Secret`'s `files` attribute.

Use
===

First, run `make install` and it will build this as a Go plugin and install it
into your `$XDG_CONFIG_HOME`. (The Makefile is small, so you can read it to see
exactly what it's doing.)

Then, you'll create your `Secret` yaml file normally but with a few changes:

* `apiVersion` should be set to `apiVersion: kustomize-age/v1`
* `kind` should be set to `OndiskEncryptedSecret` instead of `Secret` (though,
  the final object that's added to your k8s cluster will be a `Secret`).
* `files` should be the file paths you want decrypted and stored in the `Secret`
  without the `.age` suffix on them. For example, a `mycredentials.key` in
  `files` of the `OndiskEncryptedSecret` will correspond to the age encrypted
  file on disk at `mycredentials.key.age`)

Those `.age` file paths will be the file paths you wanted included in the
`Secret` but encrypted with the `age` key specified.

By default, the `age` key used to decrypt these files is expected to be in the
`KUBE_AGE_KEY` environment variable. The environment variable used can be
overrided by setting the `ageKeyEnvVar` in the `OndiskEncryptedSecret`.

Example
=======

Supposing you have a file path you want in your secret at
`mycredentials.key.age`

```
$ ls
mycredentials.key.age mycredentials.yaml

$ cat mycredentials.yaml
apiVersion: kustomize-age/v1
kind: OndiskEncryptedSecret
metadata:
    name: some-svc-credentials
files:
    - mycredentials.key

# likely, you'll want to delete this next line and use the
# default KUBE_AGE_KEY env var.
ageKeyEnvVar: ANOTHER_ENV_VAR
```

Caveat
======
As with many Go plugins, you may have to fork this repo and adjust its `go.mod`
in order to correct package mismatches with your `kustomize` binary.

kustomize-age

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README