ConfigMapSecrets

Problem

I have a config that contains a mixture of secret and non-secret data. For some reason I can't use environment variables to reference the secret data. I want to check my config into source control, keep my secret data secure, and keep my non-secret data easily readable and editable.

Solution

Use a ConfigMapSecret which is safe to store in source control. It's like a ConfigMap that includes your non-secret data, but it can reference Secret variables, similar to how container args can reference env variables. The controller will expand and render it into a Secret in the same namespace, keeping it updated to reflect changes to the ConfigMapSecret or its referenced variables.

Use SealedSecrets to keep your referenced Secret data secure.

Installation

kubectl apply -f manifest/*.yaml

Example

Input

apiVersion: secrets.mz.com/v1alpha1kind: ConfigMapSecretmetadata:
name: alertmanager-confignamespace: monitoringlabels:
app: alertmanagerspec:
template:
metadata:
# optional: name defaults to same as ConfigMapSecretname: alertmanager-configlabels:
app: alertmanagerdata:
alertmanager.yaml: | global: resolve_timeout: 5m opsgenie_api_key: $(OPSGENIE_API_KEY) slack_api_url: $(SLACK_API_URL) route: receiver: default group_by: ["alertname", "job", "team"] group_wait: 30s group_interval: 5m repeat_interval: 12h routes: - receiver: foobar-sre match: team: foobar-sre - receiver: widget-sre match: team: widget-sre receivers: - name: default slack_configs: - channel: unrouted-alerts - name: foobar-sre opsgenie_configs: - responders: - name: foobar-sre type: team slack_configs: - channel: foobar-sre-alerts - name: widget-sre opsgenie_configs: - responders: - name: widget-sre type: team slack_configs: - channel: widget-srevars:
- name: OPSGENIE_API_KEYsecretValue:
name: alertmanager-keyskey: opsgenieKey
- name: SLACK_API_URLsecretValue:
name: alertmanager-keyskey: slackURL
---
apiVersion: v1kind: Secretmetadata:
name: alertmanager-keysnamespace: monitoringlabels:
app: alertmanagerstringData:
opsgenieKey: 9eccf784-bbad-11e9-9cb5-2a2ae2dbcce4slackURL: https://hooks.slack.com/services/EFNPN1/EVU44X/J51NVTYSKwuPtCz3type: Opaque

Output

apiVersion: v1kind: Secretmetadata:
name: alertmanager-confignamespace: monitoringlabels:
app: alertmanagerstringData:
alertmanager.yaml: | global: resolve_timeout: 5m opsgenie_api_key: 9eccf784-bbad-11e9-9cb5-2a2ae2dbcce4 slack_api_url: https://hooks.slack.com/services/EFNPN1/EVU44X/J51NVTYSKwuPtCz3 route: receiver: default group_by: ["alertname", "job", "team"] group_wait: 30s group_interval: 5m repeat_interval: 12h routes: - receiver: foobar-sre match: team: foobar-sre - receiver: widget-sre match: team: widget-sre receivers: - name: default slack_configs: - channel: unrouted-alerts - name: foobar-sre opsgenie_configs: - responders: - name: foobar-sre type: team slack_configs: - channel: foobar-sre - name: widget-sre opsgenie_configs: - responders: - name: widget-sre type: team slack_configs: - channel: widget-sretype: Opaque