cci-moc / cephfs-provisioner-example Goto Github PK

• Install kustomize:

  mkdir -p ~/bin
  curl -L https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv4.0.1/kustomize_v4.0.1_linux_amd64.tar.gz |
    tar -C ~/bin -xzf -
  

• Install sops:

  mkdir -p ~/bin
  curl -L -o ~/bin/sops https://github.com/mozilla/sops/releases/download/v3.6.1/sops-v3.6.1.linux
  chmod 755 ~/bin/sops
  

• Install KSOPS:

  plugindir=~/.config/kustomize/plugin/viaduct.ai/v1/ksops
  mkdir -p $plugindir
  curl -L https://github.com/viaduct-ai/kustomize-sops/releases/download/v2.4.0/ksops_2.4.0_Linux_x86_64.tar.gz |
    tar -C $plugindir -xzf -
  

To render YAML to stdout:

kustomize build --enable-alpha-plugins

To create (or update) resources in OpenShift:

kustomize build --enable-alpha-plugins | oc apply -f-

The kustomize command reads kustomizations.yml and renders on stdout resources declared in the resources key. It will add a namespace key to the resources using the value declared in the namespace key.

The generators section declares resources that are generated dynamically. The secret-generator.yml file instructs kustomize to generate resources from ceph-admin-secret.yaml andf ceph-client-secret.yaml using the viaduct.ai/v1/ksops plugin. kustomize will look for plugins in subdirectories of ~/.config/kustomize/plugin (where it will find the ksops plugin you installed from the Prerequisities section).

The KSOPS plugin uses sops to decrypt the named files. The sops command will decrypt encrypted keys using GPG. When encrypting files, it will encrypt data to the keys declared in .sops.yaml.

To edit an encrypted file:

sops <filename>

To decrypt a file to stdout:

sops -d <filename>