Package: pass-operator
passsecrets operatorA Kubernetes operator to sync and decrypt secrets from a password store (pass) Git repository. This operator is proposed as a proof-of-concept and shouldn't be used in any production capacity.While this approach to secrets management on Kubernetes is more technically challenging, the advantage is that we don't have to rely on a 3rd party SaaS platform, such as Vault or Doppler, to hold our secrets (the obvious benefits these platforms do provide, however, are better user and access management). We may also use this operator in an airgapped environment with a self-hosted git repository.How it worksThe following flowchart outlines how this operator reacts toPassSecret-related events and pass store updates.From a high level, this operator runsgit pullon an interval to grab updates from a git repository populated with encrypted
secrets bypass. It maps secrets' paths to data values through the application of aPassSecret, acustom resource, such as the following.apiVersion:secrets.premiscale.com/v1alpha1kind:PassSecretmetadata:name:mysecretnamespace:pass-operator-testspec:encryptedData:mykey:premiscale/mydatamanagedSecret:name:mysecretnamespace:pass-operator-testtype:Opaqueimmutable:falseThe abovePassSecretmanifest translates to the followingSecret.apiVersion:v1kind:Secretmetadata:name:mysecretnamespace:pass-operator-teststringData:mykey:<decrypted contents of premiscale/mydata>immutable:falsetype:OpaqueUseThis operator requires the following items to start successfully.private GPG key to decrypt the secrets that have been encrypted with a public key, locallylocal pass store (on your local development machine)git repository populated by the local password storeprivate SSH key to clone the Git repositoryI will go more in-depth and explain these requirements in the following sections.Private GPG keyThe private GPG key is used bypassto decrypt your secrets that were encrypted on your local machine.Generating GPG keysYou can find a lot of explanation about how to generate keys with GPG online, but I'll write down my process below for generating keys to use with this operator.First, generate a key.$gpg--generate-key
gpg(GnuPG)2.2.27;Copyright(C)2021FreeSoftwareFoundation,Inc.
Thisisfreesoftware:youarefreetochangeandredistributeit.
ThereisNOWARRANTY,totheextentpermittedbylaw.

Note:Use"gpg --full-generate-key"forafullfeaturedkeygenerationdialog.

GnuPGneedstoconstructauserIDtoidentifyyourkey.

Realname:EmmaDoyle
Emailaddress:emma@premiscale.com
YouselectedthisUSER-ID:"Emma Doyle <emma@premiscale.com>"Change(N)ame,(E)mail,or(O)kay/(Q)uit?O
Weneedtogeneratealotofrandombytes.Itisagoodideatoperform
someotheraction(typeonthekeyboard,movethemouse,utilizethe
disks)duringtheprimegeneration;thisgivestherandomnumber
generatorabetterchancetogainenoughentropy.
Weneedtogeneratealotofrandombytes.Itisagoodideatoperform
someotheraction(typeonthekeyboard,movethemouse,utilizethe
disks)duringtheprimegeneration;thisgivestherandomnumber
generatorabetterchancetogainenoughentropy.
gpg:key4B90DE5D5BF143B8markedasultimatelytrusted
gpg:revocationcertificatestoredas'/home/emmadoyle/.gnupg/openpgp-revocs.d/51924ADAFC92656FAFEB672D4B90DE5D5BF143B8.rev'publicandsecretkeycreatedandsigned.

pubrsa30722024-01-12[SC][expires:2026-01-11]51924ADAFC92656FAFEB672D4B90DE5D5BF143B8
uidEmmaDoyle<emma@premiscale.com>
subrsa30722024-01-12[E][expires:2026-01-11]Important:if you specify a password for your key, you'll need to specify this password in the Helm values.You'll now see your key on your keyring.$gpg--list-keys51924ADAFC92656FAFEB672D4B90DE5D5BF143B8
pubrsa30722024-01-12[SC][expires:2026-01-11]51924ADAFC92656FAFEB672D4B90DE5D5BF143B8
uid[ultimate]EmmaDoyle<emma@premiscale.com>
subrsa30722024-01-12[E][expires:2026-01-11]Export your private key and b64 encode it (otherwise it will dump a bunch of binary data to your shell).$gpg--armor--export-secret-keys51924ADAFC92656FAFEB672D4B90DE5D5BF143B8|base64
...Copy this value and update yourHelm values.Password storeInstallpassand initialize a local store using the GPG keys you generated in the last step.passinit"$GPG_KEY_ID"--path<subpathof~/.password-store/>Now, on your local machine,$ls-lash~/.password-store/repo/
total12K4.0Kdrwx------2emmadoyleemmadoyle4.0KJan1513:36.4.0Kdrwxrwxr-x13emmadoyleemmadoyle4.0KJan1513:36..4.0K-rw-------1emmadoyleemmadoyle41Jan1513:36.gpg-idGit repositoryFrom thepassman page,...
pass git git-command-args...
        If the password store is a git repository, execute a git command
        specified by git-command-args.
...we may easily link our local password store to a remote Git repository. This operator usesgitalongsidepassto pull secret updates.$gitinit~/.password-store/repo/
$ls-lash~/.password-store/repo/
total16K4.0Kdrwx------3emmadoyleemmadoyle4.0KJan1513:38.4.0Kdrwxrwxr-x13emmadoyleemmadoyle4.0KJan1513:36..4.0Kdrwxrwxr-x7emmadoyleemmadoyle4.0KJan1513:38.git4.0K-rw-------1emmadoyleemmadoyle41Jan1513:36.gpg-idPrivate SSH keyNow add a remote git repository and watch aspass insert-commands create local commits automatically. Sync your local password store with the remote repo viapass git push.DevelopmentTestingRun unit tests withpoetryrunpytesttests/unite2e tests against a live environment withpoetryrunpytesttests/e2eAnd coverage against the codebase withpoetryruncoveragerun-mpytest
poetryruncoveragereport-mpytest