Skip to content
Tech Insights

Using ArgoCD with the Helm Secret Plugin

argocdhelm
On this page

Configuration

Helm is a useful tool that helps users easily install and update applications in a Kubernetes environment; however, since it does not include built-in functionality to manage secret data separately, there is a risk that user data—such as passwords and tokens—could be exposed.

To address this, it is recommended to install and use the Helm Secret Plugin.

This plugin encrypts the values file in Helm charts for storage and management.

This means that even when stored in the source repository in an encrypted state, the risk of data exposure is reduced.

However, since the Helm Secret Plugin is not designed to encrypt files directly but rather to utilize a separate backend program, you must install that program as well.

In other words, to use the Helm Secret Plugin, you must install the backend program `sops`.

Installing sops

# sops binary 다운로드
curl -LO https://github.com/getsops/sops/releases/download/v3.8.1/sops-v3.8.1.linux.amd64

# binary를 PATH로 이동
mv sops-v3.8.1.linux.amd64 /usr/local/bin/sops

# binary에 실행 권한 부여
chmod +x /usr/local/bin/sops

Public:Private Key

Next, you’ll need a key file that sops will use to encrypt files.

The key file is used to encrypt files and to modify or decrypt encrypted files.

Since anyone with the key can view or modify secret files, it is important to manage the key carefully.

Although both GPG and AGE are supported, the official Helm Secret Plugin documentation recommends using AGE.

Therefore, this guide will explain the process using AGE.

There are two key methods supported by both SOPs and ArgoCD.

  • GPG: This method involves installing a client to manage keys, which can be challenging.

  • AGE: This is the method recommended in the official Helm Secret Plugin documentation.

Installing Age

Retrieve the latest version from the GitHub repository

AGE_LATEST_VERSION=$(curl -s "https://api.github.com/repos/FiloSottile/age/releases/latest" | grep -Po '"tag_name": "v\K[0-9.]+')

Use curl to download the latest .tar.gz file

curl -Lo age.tar.gz "https://github.com/FiloSottile/age/releases/latest/download/age-v${AGE_LATEST_VERSION}-linux-amd64.tar.gz"

Unzip the downloaded .tar.gz file

tar xf age.tar.gz

After extracting, move `age` and `age-keygen` to `/usr/local/bin`

sudo mv age/age /usr/local/bin
sudo mv age/age-keygen /usr/local/bin

Clean up unnecessary files

rm -rf age.tar.gz
rm -rf age

Verify that age and age-keygen are working

age -version
age-keygen -version

Generate a key using age:

age-keygen -o key.txt

Set the location of the generated key and the public key as environment variables as shown below so that SOPs can use the key.

export SOPS_AGE_KEY_FILE="/root/key.txt"
export SOPS_AGE_RECIPIENTS="age 퍼블릭키"

Install the Helm Secrets plugin

helm plugin install https://github.com/jkroepke/helm-secrets --version v4.6.0

The steps up to this point involved installing and configuring the necessary programs on the development or management server; now we’ll begin configuring the Helm Secrets plugin within ArgoCD.

Adding the Helm Secrets Plugin to ArgoCD

There are two ways to add the secrets plugin to ArgoCD.

  • Building the ArgoCD container image directly

  • Using an initContainer to configure the necessary settings

Since building the container image has the drawback of requiring a rebuild every time you upgrade to a new version, I will explain the method using an initContainer, which makes upgrades relatively easier.

To do this, install the ArgoCD Helm chart and configure the necessary settings via the `values` file.

First, add the schema that ArgoCD allows for the location of an external `values` file.

server:
  config:
    helm.valuesFileSchemes: >-
      secrets+gpg-import, secrets+gpg-import-kubernetes,
      secrets+age-import, secrets+age-import-kubernetes,
      secrets,secrets+literal,
      https, http

Environment variable settings required to add the plugin

repoServer:
  env:
    - name: HELM_PLUGINS
      value: /custom-tools/helm-plugins/
    - name: HELM_SECRETS_SOPS_PATH
      value: /custom-tools/sops
    - name: HELM_SECRETS_BACKEND
      value: sops
    - name: HELM_SECRETS_VALUES_ALLOW_SYMLINKS
      value: "false"
    - name: HELM_SECRETS_VALUES_ALLOW_ABSOLUTE_PATH
      value: "true"
    - name: HELM_SECRETS_VALUES_ALLOW_PATH_TRAVERSAL
      value: "false"
    - name: HELM_SECRETS_WRAPPER_ENABLED
      value: "true"
    - name: HELM_SECRETS_DECRYPT_SECRETS_IN_TMP_DIR
      value: "true"
    - name: HELM_SECRETS_HELM_PATH
      value: /usr/local/bin/helm

Add a script to the initContainer to download the SOPs and Helm secrets binaries

  initContainers:
    - name: download-tools
      image: alpine:latest
      imagePullPolicy: IfNotPresent
      command: [sh, -ec]
      env:
        - name: HELM_SECRETS_VERSION
          value: "4.6.0"
        - name: SOPS_VERSION
          value: "3.8.1"
      args:
        - |
          mkdir -p /custom-tools/helm-plugins
          wget -qO- https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/helm-secrets.tar.gz | tar -C /custom-tools/helm-plugins -xzf-;
          wget -qO /custom-tools/sops https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64
          cp /custom-tools/helm-plugins/helm-secrets/scripts/wrapper/helm.sh /custom-tools/helm
          chmod +x /custom-tools/*
      volumeMounts:
        - mountPath: /custom-tools
          name: custom-tools

Mount the files required for ArgoCD’s repo server container via a volume.

  volumeMounts:
    - mountPath: /custom-tools
      name: custom-tools
    - mountPath: /usr/local/sbin/helm
      subPath: helm
      name: custom-tools
    - mountPath: /helm-secrets-private-keys/
      name: helm-secrets-private-keys

  volumes:
    - name: custom-tools
      emptyDir: {}
    - name: helm-secrets-private-keys
      secret:
        secretName: helm-secrets-private-keys

Before installing the ArgoCD Helm chart, you must create the previously generated `age` key as a Kubernetes secret so that ArgoCD can use it.

kubectl create secret generic helm-secrets-private-keys --from-file=key.txt=key.txt

Now, use the values file you created to install the ArgoCD Helm chart, and an ArgoCD instance capable of using the secrets plugin will be deployed.

How to Use

When creating an app in ArgoCD and wanting to use an encrypted `values` file, specify the `values` file in the same way as before; however, when providing the path to the encrypted `values` file, you must prefix it with the correct schema.

Example of values file configuration:

secrets+age-import:///helm-secrets-private-keys/key.txt?values-enc.yaml
secrets+age-import:///helm-secrets-private-keys/key.txt?http://gitlab.com/values-enc.yaml

First, set the schema to secrets+age-import:// .

This means the file is loaded using the "age" key.

Next, /helm-secrets-private-keys/key.txt is the location of the `age` key file mounted inside the `repoServer` container.

Finally, the part after the ? ?http://gitlab.com/values-enc.yaml is the location of the encrypted `values` file.

Reference:

Back to list