Encrypting secret to read GitHub source in Flux

Question

In my Kubernetes cloud I do have FluxCD to manage all components. FluxCD is using SOPS to decrypt all the passwords. This is resulting in a declaration like this:

---
apiVersion: source.toolkit.fluxcd.io/v1beta1
kind: GitRepository
metadata:
  name: load-balancer-controller
  namespace: flux-system
spec:
  interval: 1m
  ref:
    branch: main
  url: https://github.com/fantasyaccount/load-balancer-controller.git

---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
kind: Kustomization
metadata:
  name: load-balancer-controller
  namespace: flux-system
spec:
  decryption:
    provider: sops
    secretRef:
      name: sops-gpg
  interval: 1m
  path: "./deployment"
  prune: true
  sourceRef:
    kind: GitRepository
    name: load-balancer-controller

Within the load-balancer-controller repo I can use SOPS encrypted secrets. That is clear for me.

However, is it possible to use SOPS as well for encrypting the secret token to have access to the repo itself? I know I can use kubectl create secret ... to add the secret token to Kubernetes as well, but that is now what I want. I would like to use a SOPS encrypted token here as well.

Answer 1

The challenge in encrypting the secret for the initial GitRepository, is to then define what the cluster provisioning process would look like, as this represents a bit of a chicken-egg problem.

One way I can see this working, is to install Flux with a source that supports contextual authentication, such as Bucket. With that, you could store in an S3 Bucket the encrypted Git secret, the GitRepository to current repository, and the Kustomization that applies it to your cluster.

Here's more information about the contextual authentication for EKS: https://fluxcd.io/docs/components/source/buckets/#aws-ec2-example

Just notice that with this approach, your cluster deployment pipeline would have to store your GPG key, as you would need to deploy that secret before (or soon after) you install Flux into the cluster.