1276
Comment:
|
← Revision 5 as of 2020-06-30 09:57:33 ⇥
1467
|
Deletions are marked like this. | Additions are marked like this. |
Line 9: | Line 9: |
* Notes: I missed the fact that helm secrets expect the secret files to be names secrets.yaml (or secrets<xxx>.yaml) | |
Line 12: | Line 13: |
Line 17: | Line 19: |
AZ_AKV_NAME="helm-nsp-prd" ## Create multiple key vaults and keys each in a vault e.g. keya in helm-keya-prd, keyb in helm-keyb-prd for ch in keya keyb; do AZ_AKV_NAME="helm-$ch-prd" |
az account set --subscription "$AZ_AKV_SUBSCRIPTION" ## Create multiple key vaults and keys each in a vault e.g. keya in helm-comp-dev, keyb in helm-comp-prd ch="fdnb" for en in prd; do AZ_AKV_NAME="helm-$ch-$en" |
Line 27: | Line 29: |
#now check for kv in dns, it takes a couple of seconds, dont want to polute global dns beore it exists. | |
Line 28: | Line 31: |
while [[ i -le 45 ]] || ! nslookup $AZ_AKV_NAME.vault.azure.net ns1-01.azure-dns.com do |
while [[ i -le 45 ]] ; do |
Line 37: | Line 41: |
k8s/helm/secrets - secure secrets with encryption in helm git repo
Links: https://github.com/mozilla/sops
Install plugin to helm
$ helm plugin install https://github.com/futuresimple/helm-secrets ##>> install package sops
Notes: I missed the fact that helm secrets expect the secret files to be names secrets.yaml (or secrets<xxx>.yaml)
Using keys in Azure Key vaults
Create key
AZ_AKV_RG="akv-infra" AZ_AKV_LOCATION="Australia Southeast" AZ_AKV_SUBSCRIPTION="Infrastructure" az account set --subscription "$AZ_AKV_SUBSCRIPTION" ## Create multiple key vaults and keys each in a vault e.g. keya in helm-comp-dev, keyb in helm-comp-prd ch="fdnb" for en in prd; do AZ_AKV_NAME="helm-$ch-$en" echo "AZ_AKV_NAME=$AZ_AKV_NAME , AZ_AKV_LOCATION=$AZ_AKV_LOCATION , AZ_AKV_RG=$AZ_AKV_RG" if ! az keyvault create --name $AZ_AKV_NAME --location "$AZ_AKV_LOCATION" --resource-group $AZ_AKV_RG then echo "ERROR" ; exit 1 fi #now check for kv in dns, it takes a couple of seconds, dont want to polute global dns beore it exists. i=0 while [[ i -le 45 ]] ; do i=$((i+1)) sleep 1 ; echo "i=$i dns for key vault does not exist yet sleep some more ..." done echo " Now create key --name $AZ_AKV_NAME in --vault-name $AZ_AKV_NAME " az keyvault key create --name $AZ_AKV_NAME --vault-name $AZ_AKV_NAME --protection software --ops encrypt decrypt done