KubeKrypt

A command-line tool for securely encrypting and decrypting Kubernetes Secret manifests using Google Cloud KMS encryption keys.

KubeKrypt provides a simple and secure way to manage sensitive information in Kubernetes Secret manifests. It allows you to encrypt Secret manifests before they're stored in version control systems, and decrypt them when they need to be applied to a cluster.

• Secure Encryption: Uses Google Cloud KMS to encrypt sensitive data in Kubernetes Secret manifests
• Simple Interface: Easy-to-use CLI commands for encryption and decryption
• Metadata Tracking: Embeds metadata in encrypted files for tracking and verification
• Stdout Integration: Outputs to standard out for easy piping and redirection
• Base64 Processing: Automatically handles base64 encoding/decoding under the hood, maintaining compatibility with Kubernetes Secret format

kubecrypt uses google-cloud-kms and it requires an environment variable to be set in order to authenticate and work properly. You need one of:

• GOOGLE_CLOUD_CREDENTIALS - Path to JSON file, or JSON contents
• GOOGLE_APPLICATION_CREDENTIALS - Path to JSON file

kubekrypt encrypt secret.yaml -k projects/your-project/locations/global/keyRings/your-keyring/cryptoKeys/your-key > secret.enc.yaml

kubekrypt decrypt secret.enc.yaml > secret.yaml

kubekrypt decrypt --base64 secret.enc.yaml | kubectl apply -f -

kubekrypt version

1. KubeKrypt reads your Kubernetes Secret YAML file

2. For encryption, it:

   • Validates that it's a proper Kubernetes Secret
   • Ensures it's not already encrypted
   • Decodes base64 values to get raw data
   • Uses Google Cloud KMS to encrypt sensitive data
   • Re-encodes with base64 as needed
   • Adds metadata about the encryption
   • Outputs the encrypted YAML

3. For decryption, it:

   • Verifies the file contains KubeKrypt encryption metadata
   • Uses the embedded information to decrypt the data
   • Handles all necessary base64 encoding/decoding
   • Outputs the original Secret YAML

KubeKrypt never stores encryption keys locally. All encryption and decryption operations are performed using Google Cloud KMS, ensuring that key material is never exposed.

• Ruby 3.4+
• Access to a KMS key with appropriate permissions

Contributions are welcome! Please feel free to submit a Pull Request.

This project is licensed under the MIT License - see the LICENSE file for details.