⭐ Don't forget to star this repository! ⭐
helm-secrets is a Helm plugin to decrypt encrypted Helm value files on the fly.
- Use sops to encrypt value files and store them in git.
- Store your secrets in a cloud native secret manager like AWS SecretManager, Azure KeyVault or HashiCorp Vault and inject them inside value files or templates.
- Use helm-secret in your favorite deployment tool or GitOps Operator like ArgoCD
Who’s actually using helm-secrets? If you are using helm-secrets in your company or organization, we would like to invite you to create a PR to add your information to this file.
See Installation for more information.
For full documentation, read GitHub wiki.
Run decrypted command on specific value files. This method is preferred over the plugin command below. This mode is used in ArgoCD environments.
helm upgrade name . -f secrets:https://secrets.yaml
See Usage for more information
Wraps the whole helm
command. Slow on multiple value files.
helm secrets upgrade name . -f secrets.yaml
requires helm 3.9+; vals 0.20+
helm-secrets supports evaluating vals expressions inside Helm templates with the flag --evaluate-templates
.
secrets.yaml
apiVersion: v1
kind: Secret
metadata:
name: secret
type: Opaque
stringData:
password: "ref+awsssm:https://foo/bar?mode=singleparam#/BAR"
Run
helm secrets --evaluate-templates upgrade name .
Use AWS Secrets Manager or Azure KeyVault for storing secrets securely and reference them inside values.yaml
helm secrets --backend vals template bitnami/mysql --name-template mysql \
--set auth.rootPassword=ref+awsssm:https://foo/bar?mode=singleparam#/BAR
See Cloud Integration for more information.
For running helm-secrets with ArgoCD, see ArgoCD Integration for more information.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: app
spec:
source:
helm:
valueFiles:
- secrets+gpg-import:https:///helm-secrets-private-keys/key.asc?secrets.yaml
- secrets+gpg-import-kubernetes:https://argocd/helm-secrets-private-keys#key.asc?secrets.yaml
- secrets:https://secrets.yaml
# fileParameters (--set-file) are supported, too.
fileParameters:
- name: config
path: secrets:https://secrets.yaml
# directly reference values from Cloud Providers
- name: mysql.rootPassword
path: secrets+literal:https://ref+azurekeyvault:https://my-vault/secret-a
The Terraform Helm provider does not support downloader plugins.
helm-secrets can be used together with the Terraform external data source provider.
data "external" "helm-secrets" {
program = ["helm", "secrets", "decrypt", "--terraform", "../../examples/sops/secrets.yaml"]
}
resource "helm_release" "example" {
values = [
file("../../examples/sops/values.yaml"),
base64decode(data.external.helm-secrets.result.content_base64),
]
}
An example of how to use helm-secrets with Terraform can be found in examples/terraform.
helm-secrets support multiple secret backends. Currently, sops and vals are supported.
See Secret-Backends how to use them.
Additional documentation, resources and examples can be found here.
scripts/run.sh
- Main helm-secrets plugin code for all helm-secrets plugin actions available inhelm secrets help
after plugin installscripts/backends
- Location of the in-tree secrets backendsscripts/commands
- Sub Commands ofhelm secrets
are defined here.scripts/lib
- Common functions used byhelm secrets
.scripts/wrapper
- Wrapper scripts for Windows systems.tests
- Test scripts to check if all parts of the plugin work. Using test assets with PGP keys to make real tests on real data with real encryption/decryption. Seetests/README.md
for more information.examples
- Some example secrets.yaml
© 2020-2022 Jan-Otto Kröpke (jkroepke)
© 2017-2020 Zendesk
Licensed under the Apache License, Version 2.0