Skip to content

STACKIT.md

Latest commit

 

History

History
161 lines (120 loc) · 4.47 KB

STACKIT.md

File metadata and controls

161 lines (120 loc) · 4.47 KB
Raw

SOPS with STACKIT KMS

This repository is a fork of getsops/sops that adds STACKIT KMS as a key source. It exists until getsops/sops#2094 is merged. Files encrypted with this fork use the same metadata format as that pull request, so upstream SOPS releases that include it can read them.

Versions

Each release is an upstream release plus the STACKIT KMS change. Tags have the form vX.Y.Z-stackit.N, where vX.Y.Z is the upstream release and N counts fork releases on top of it.

Installation

mise

Install with mise:

mise use -g 'github:stackitcloud/sops[bin=sops]'

Or pin it per project in mise.toml:

[tools]
"github:stackitcloud/sops" = { version = "3.13.3-stackit.2", bin = "sops" }

The release assets are plain binaries with the version in the name. bin = "sops" installs them as sops.

mise can hide releases newer than its minimum release age, so latest may find no version right after a release. Pin the version, or exclude the fork from the check:

[settings]
minimum_release_age_excludes = ["github:stackitcloud/sops"]

Binary (macOS, Linux)

API=https://api.github.com/repos/stackitcloud/sops/releases/latest
VERSION=$(curl -fsSL "$API" \
  | grep -o '"tag_name": *"[^"]*"' | cut -d'"' -f4)
OS=linux     # or darwin
ARCH=amd64   # or arm64
BASE=https://github.com/stackitcloud/sops/releases/download
curl -fLo sops "${BASE}/${VERSION}/sops-${VERSION}.${OS}.${ARCH}"
chmod +x sops
sudo mv sops /usr/local/bin/sops

Windows binaries (sops-vX.Y.Z-stackit.N.amd64.exe) are on the releases page.

The macOS binaries are signed by Developer ID Application: Schwarz IT KG (5DR5YYJ2CC) and notarized by Apple. To check one:

spctl --assess --type install --verbose /usr/local/bin/sops

Debian, Ubuntu (.deb)

ARCH=amd64   # or arm64
curl -fsSL https://api.github.com/repos/stackitcloud/sops/releases/latest \
  | grep -o "https://[^\"]*_${ARCH}\.deb" | xargs curl -fLO
sudo dpkg -i sops_*_${ARCH}.deb

RHEL, Fedora, openSUSE (.rpm)

ARCH=x86_64   # or aarch64
curl -fsSL https://api.github.com/repos/stackitcloud/sops/releases/latest \
  | grep -o "https://[^\"]*\.${ARCH}\.rpm" | xargs curl -fLO
sudo rpm -Uvh sops-*.${ARCH}.rpm

Container image

docker run --rm ghcr.io/stackitcloud/sops:v3.13.3-stackit.1 --version

Images are tagged vX.Y.Z-stackit.N and vX.Y.Z-stackit.N-alpine. There is no latest tag.

Go

go install does not work, because the Go module path stays github.com/getsops/sops/v3.

Usage

Set the STACKIT KMS key in .sops.yaml:

creation_rules:
  - stackit_kms: >-
      projects/<project>/regions/eu01/keyRings/<ring>/keys/<key>/versions/1

On the command line, use --stackit-kms or SOPS_STACKIT_KMS_IDS. sops updatekeys, --add-stackit-kms and --rm-stackit-kms work like the other key sources.

Authentication uses the default STACKIT SDK credentials.

Releasing

The stackit branch is the latest upstream release tag plus the fork commits. main is a copy of upstream main and gets no fork commits.

To release on top of a new upstream tag vNEW, where vOLD is the current base:

git fetch upstream --tags
git checkout stackit
git rebase --onto vNEW vOLD stackit

If go.mod or go.sum conflict, take the upstream files and add the STACKIT SDK again:

git checkout --ours go.mod go.sum
go get github.com/stackitcloud/stackit-sdk-go/core@latest \
  github.com/stackitcloud/stackit-sdk-go/services/kms@latest
go mod tidy
git add go.mod go.sum
git rebase --continue

Then push the upstream base tag, the branch and the release tag. The release notes cover the changes since the base tag, which this repository keeps as upstream/vNEW. Upstream v* tags must not be pushed here: they would start the release workflow of the upstream commit. Wait for the CLI workflow to pass on stackit before pushing the release tag.

git tag upstream/vNEW 'vNEW^{}'
git push origin upstream/vNEW
git push --force-with-lease origin stackit
git tag vNEW-stackit.1
git push origin vNEW-stackit.1

The release workflow publishes binaries, packages and images. It signs and notarizes the macOS binaries with the secrets of the signing environment, see .github/workflows/release.yml.