Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Return kms encryption for ArgoCD configurations #235

Open
wallhided opened this issue Feb 14, 2023 · 1 comment
Open

Return kms encryption for ArgoCD configurations #235

wallhided opened this issue Feb 14, 2023 · 1 comment
Assignees
Labels

Comments

@wallhided
Copy link
Contributor

During upgrading of sak-argocd module, kms enc/decr functionality was removed.
This functionality should be done in other ways as it was done here - sak-argocd main.tf

Some modules like sak-prometheus still use it. (but without kms encrypting at all)

@wallhided wallhided added enhancement New feature or request sak-argocd labels Feb 14, 2023
@wallhided wallhided self-assigned this Feb 14, 2023
@wallhided
Copy link
Contributor Author

wallhided commented Feb 17, 2023

My status:

  1. Since argocd project get rid of python in their docker images - old integration with python script which decrypts application configs during "generation" no longer works. Currently there are no options of using old script, except re-build base ArgoCD image and keep it in public repo.
  2. There additional options like SOPS with using AWS KMS for encryption, but unfortunately there are following problems with implementing such feature:
  • User should manually encrypt file with sops utility. (Currently, there are no options to do that via terraform)
  • Decryption on fly happens only for file with helm values, we provide single file with application configuration with all helm parameters. This approach requires many steps for user to do.

I'm freezing this ticket, since there are no viable options for now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant