Demo repository on using Mozilla SOPs to encrupt secrets during Kong deployment and configurations.
We tested this exercise in MacOS, some variation are expected
Let's generate a key pair using age. Pl As you might expect with any other encryption scheme, the public key is the one we use to encrypt (and itβs okay to share), while the secret key decrypts data (and must be kept private, recommend to use a password manager).
age-keygen -o sops-key.txt
Public key: xxxx
cat sops-key.txt
AGE-SECRET-KEY-XXXXXXXXXX
Next, make encryption easier by creating a small configuration file for SOPS. This allows you to encrypt quickly without telling SOPS which key you want to use.
Create a .sops.yaml file like this one in the root directory of our repository
creation_rules:
- encrypted_regex: '^(data|stringData)$'
age: xxxxx-age-public-key
Sample configuration file (encrypted) can be found in kube/config