How to integrate helm-secrets with ArgoCD?

Use protocol handlers like secrets:// in ArgoCD's helm.valueFiles or fileParameters, as shown in the README example. Ensure ArgoCD has access to decryption keys or cloud credentials via sidecars or init containers.

helm-secrets vs sealed secrets: which should I use?

helm-secrets integrates directly into Helm workflows and supports cloud secret managers, while sealed secrets is Kubernetes-native and encrypts secrets into CRDs. Choose based on whether you prefer Helm-centric automation or a pure Kubernetes approach.

Can I use helm-secrets without installing sops?

Yes, you can use the vals backend to reference secrets from cloud providers like AWS or Azure without sops, as noted in the Secret Backends wiki. This allows cloud-native secret management without file encryption.

How to decrypt secrets in a CI/CD pipeline with helm-secrets?

In CI/CD, use the protocol handler method (e.g., -f secrets://secrets.yaml) for better performance, or wrap commands with helm secrets. Ensure the pipeline environment has the necessary keys or IAM roles for decryption.

What encryption methods does helm-secrets support with sops?

It supports sops with various key services like PGP, AWS KMS, Azure Key Vault, and GCP KMS, as implied by the sops integration. The README references sops for encrypting value files, but specific methods depend on sops configuration.

How to handle key rotation with helm-secrets?

Key rotation is managed by the backend (sops or vals). For sops, you must manually re-encrypt files with new keys. The README doesn't provide automated rotation, so it requires careful planning and manual updates in Git.

Open-Awesome

helm-secrets

Apache-2.0Shellv4.7.7

A Helm plugin that manages secrets using Git workflows and integrates with cloud secret managers.

Visit Website GitHub

2.0k stars154 forks0 contributors

What is helm-secrets?

helm-secrets is a Helm plugin that helps manage secrets for Kubernetes deployments. It allows users to encrypt Helm value files with sops for secure Git storage and integrates with cloud secret managers like AWS Secrets Manager and Azure KeyVault. The plugin solves the problem of securely handling sensitive data in Helm charts while maintaining automation and GitOps practices.

Target Audience

DevOps engineers, SREs, and platform teams deploying applications with Helm in Kubernetes environments, especially those adopting GitOps workflows with tools like ArgoCD.

Value Proposition

Developers choose helm-secrets because it seamlessly integrates secret management into existing Helm workflows, supports multiple backends and cloud providers, and enables secure, automated deployments without compromising on GitOps principles.

Overview

A helm plugin that help manage secrets with Git workflow and store them anywhere

Use Cases

Best For

Securely storing Helm secrets in Git repositories
Integrating cloud secret managers with Helm deployments
Automating secret injection in ArgoCD GitOps pipelines
Managing encrypted configuration files in CI/CD workflows
Using Terraform to deploy Helm charts with secrets
Referencing dynamic secrets from AWS or Azure in Helm templates

Not Ideal For

Projects relying solely on Kubernetes ConfigMaps or environment variables without sensitive data encryption needs
Teams already using HashiCorp Vault's native Kubernetes integration without Helm-specific secret handling
Environments where Helm is not deployed, such as those using Kustomize or direct kubectl apply
Simple deployments where managing encryption keys and external tools adds unjustified overhead

Pros & Cons

Pros

Secure Git Storage

Uses sops to encrypt Helm value files, allowing safe storage in Git repositories, which is explicitly designed for GitOps workflows as shown in the README's emphasis on Git-centric secret management.

Cloud Secret Integration

Directly references secrets from AWS Secrets Manager, Azure KeyVault, and HashiCorp Vault, enabling dynamic injection without manual steps, as detailed in the Cloud Integration section.

GitOps Compatibility

Integrates seamlessly with ArgoCD via protocol handlers like secrets://, supporting automated deployments in GitOps pipelines, with examples provided in the ArgoCD Integration wiki.

Template Evaluation Support

Evaluates vals expressions inside Helm templates with the --evaluate-templates flag, allowing dynamic secret references, as demonstrated in the README for Helm 3.9+ and vals 0.20+.

Cons

Performance Overhead

The plugin command mode is noted as 'slow on multiple value files' in the README, which can degrade deployment speed in complex charts with numerous secret files.

Setup Complexity

Requires installing and configuring external tools like sops or vals, along with managing encryption keys or cloud credentials, adding significant initial setup effort beyond Helm itself.

Terraform Limitations

Integration with Terraform is cumbersome, relying on external data sources due to the Helm provider's lack of downloader plugin support, as admitted in the Terraform support section.

Frequently Asked Questions

Related Projects

trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Stars37,051

Forks552

Last commit20 hours ago

Sops

Simple and flexible tool for managing secrets

Prevents you from committing secrets and credentials into git repositories

Stars13,350

Forks1,255

Last commit10 months ago

clair

Vulnerability Static Analysis for Containers

Stars11,030

Forks1,216

Last commit2 days ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub