communication-keys/README.md

GPG Key Repo

Purpose: Manage gpg keys for:

• SOPS

Key Management

howto create and add a gpg key

• please follow instruction on following link: https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key
• add ONLY the PUBLIC part of your gpg key!!!
• checkin via MergeRequest/PullRequest

import gpg keys

gpg --import /path/to/keys/*.gpg.pub

list imported gpg keys

gpg --list-keys --keyid-format=long

EOL: Archive Expired Keys

To mark a key as expired, move it to the archive/ dir as follows:

mv ${keyname} "archive/${keyname}_$(date '+%Y-%m-%d').archive"

Configure SOPS

SOPS is used for encrypting secrets, e.g. credentials for various systems

Install

https://github.com/getsops/sops

Note:

• MacOS: If desired, one can also use brew to install sops: brew install sops; although this is not officially maintained, the formula is essentially the same as the official installation instructions

Usage

Decrypt and Display Secrets in Terminal:

GPG_TTY=$(tty) sops secrets.yaml

Note: The GPG_TTY is necessary to have the password prompt appear. src: https://www.varokas.com/secrets-in-code-with-mozilla-sops/

Note: secrets.yaml is just an example; the file can have any name

Example - Manual

The steps in the following example can be run locally in order to:

• create a sample secrets file
• encrypt the file
• decrypt the file

If these steps work, sops configured correctly - on your machine ;-)

#!/usr/bin/env bash
set -ueo pipefail
# demo: create a file with a mock secret, src: https://bash-org-archive.com/?244321
yq -n '.demo.credentials.secret = "hunter2"' > secrets.yaml
# encrypt
sops -e -i secrets.yaml

# decript, print to console
sops -d secrets.yaml

Example - Automation

cd example/
./cmd_sops.sh

Automation

# E.g. update sops config for DevNSO
% git clone git@git.dev-at.de:cloud-solutions/nso/devnso-adp-argocd.git
% cd devnso-adp-argocd/
% ${PATH_TO_THIS_REPO}/bin/update_sops.sh

# List available roles
% ${PATH_TO_THIS_REPO}/bin/update_sops.sh --list_roles
# INFO: listing roles
admin
automation
devnso-adp-argocd

# For a given role, update sops config and specified secrets file
% ${PATH_TO_THIS_REPO}/bin/update_sops.sh -r devnso-adp-argocd -s ./adp-api-devs/adp-api-devs/secrets.yaml
% git diff