A Kustomize generator plugin that creates Kubernetes Secrets from sops-encrypted files.
kustomize-sopssecretgenerator is a Kustomize generator plugin that creates Kubernetes Secrets from files encrypted with Mozilla's sops. It solves the problem of securely managing secrets in GitOps workflows by allowing encrypted secrets to be stored in version control and automatically decrypted during Kustomize builds.
Kubernetes administrators and DevOps engineers implementing GitOps workflows who need to manage encrypted secrets within their Kustomize configurations.
Developers choose this plugin because it provides a seamless, secure way to integrate sops-encrypted secrets into Kustomize builds without requiring external dependencies, while maintaining compatibility with Kustomize's native SecretGenerator patterns.
Kustomize generator plugin that generates Secrets from sops-encrypted files
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Directly decrypts sops-encrypted files in multiple formats (dotenv, INI, YAML, JSON) without requiring a separate sops binary installation, as it embeds sops internally.
Can be used as an exec KRM function, avoiding the limitations and complexity of Go plugins in Kustomize, which enhances compatibility across different setups.
Models the built-in SecretGenerator plugin, supporting generatorOptions, labels, annotations, and familiar syntax, making it easy for existing Kustomize users to adopt.
Provides documented methods for integrating into ArgoCD deployments via initContainer patching, facilitating secure GitOps workflows.
Requires Kustomize's --enable-alpha-plugins and --enable-exec flags, which are experimental and may introduce instability or lack support in production environments.
Installing as a legacy plugin involves moving binaries to specific directories like XDG_CONFIG_HOME, which can be error-prone and less intuitive than exec function usage.
Secrets are decrypted only during Kustomize build, not at runtime, which may not suit use cases needing dynamic updates without rebuilding manifests.