helm-secrets

No entries match these filters. Clear filters

1. 4.6.0 Mar 11, 2024 · release notes

   helm-secrets 4.6.0 adds a custom backend example for the 1Password CLI

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.6.0 https://github.com/jkroepke/helm-secrets.git
   # already have the repo? check out this version:
   $ git checkout 4.6.0

   └──▷ TRY IT
   Implementing a custom secret backend for Helm charts using 1Password CLI
   copy

   $ # Copy the provided example to your project directory
   cp path/to/helm-secrets/examples/backends/onepassword.sh /usr/local/bin/
   
   # Use it in your helm values file with the 'pass' plugin type pointing to the new backend
   # vault:
   #   secretManager: onepassword

2. 4.3.0 Feb 18, 2023 · release notes

   helm-secrets v4.3.0 adds template evaluation with vals, per-value-file backend override, and allowed backends env var

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.3.0 https://github.com/jkroepke/helm-secrets.git
   # already have the repo? check out this version:
   $ git checkout 4.3.0

   └──▷ TRY IT
   Evaluate template expressions in values files using the vals backend.
   copy

   $ helm-secrets install --evaluate-templates ./my-chart

   Restrict helm-secrets to only use sops and vault backends.
   copy

   $ export HELM_SECRETS_ALLOWED_BACKENDS='sops,vault'

   • Adds --evaluate-templates flag to enable evaluating secret references in Helm templates via the vals backend
   • Allows overriding the secret backend on a per-value-file basis
   • Adds HELM_SECRETS_ALLOWED_BACKENDS environment variable to restrict which backends can be used

   3 details in Everything

3. 4.2.0 Nov 8, 2022 · release notes

   helm-secrets 4.2.0 adds --ignore-missing-values flag and ? prefix for silent file-not-found handling

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.2.0 https://github.com/jkroepke/helm-secrets.git
   # already have the repo? check out this version:
   $ git checkout 4.2.0

   └──▷ TRY IT
   Deploy a Helm chart where one of the encrypted secrets file is optional and might be missing in certain environments.
   copy

   $ helm-secrets install --values secrets/optional.yaml? mychart/

   Disable all file-not-found error checks via environment variable for scripting or CI pipelines where missing files are acceptable.
   copy

   $ HELM_SECRETS_IGNORE_MISSING_VALUES=1 helm-secrets upgrade --values secrets/missing.yaml mychart/

   • Supports skipping missing value files by prefixing the path with ?.
   • Adds scoop support for shell installation.

   2 details in Everything

4. 4.1.0 Sep 20, 2022 · release notes

   helm-secrets 4.1.0 adds literal vals support via --set-file secrets+literal://

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.1.0 https://github.com/jkroepke/helm-secrets.git
   # already have the repo? check out this version:
   $ git checkout 4.1.0

   └──▷ TRY IT
   Inject a secret directly from a vault path without using a temporary file.
   copy

   $ helm secrets upgrade --install myapp ./chart --set-file auth.rootPassword=secrets+literal://ref+vault://secret/mysql#/rootPassword

5. 4.0.0 Sep 11, 2022 · release notes

   helm-secrets 4.0 adds --set-file decryption support and renames commands to encrypt/decrypt with stdout output

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.0.0 https://github.com/jkroepke/helm-secrets.git
   # already have the repo? check out this version:
   $ git checkout 4.0.0

   └──▷ USE IT
   Encrypt a file and write the result directly to stdout for piping.
   shell copy

   helm secrets encrypt my_secret.yaml

   Decrypt a file in-line (replacing its contents) using the new -i flag.
   shell copy

   helm secrets decrypt -i my_secret.yaml

   • Adds support for decrypting files defined via --set-file.
   • Changes decrypt and encrypt commands to write results to stdout by default; adds -i flag for in-line encryption/decryption.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The helm secrets dec command is renamed to helm secrets decrypt.
   • !The helm secrets enc command is renamed to helm secrets encrypt.
   • !The decrypt and encrypt commands now write results to stdout instead of files by default.
   • !Custom integrations using shell functions containing driver must rename them to backend (e.g., driver_encrypt_file to backend_encrypt_file).
   • !CLI arguments --driver, -d, and --driver-args are renamed to --backend, -b, and --backend-args.
   • !Environment variables HELM_SECRETS_DRIVER and HELM_SECRETS_DRIVER_ARGS are renamed to HELM_SECRETS_BACKEND and HELM_SECRETS_BACKEND_ARGS.
   • !The helm secret clean command is removed.
   • !The helm secret terraform command is removed; use helm secret decrypt --terraform instead.
   • !The helm secret view command is removed; use helm secret decrypt instead.
   • !The vault, envsubst, and droppler drivers are removed.
   • !The sops:// protocol handler is removed.
   • !The secret:// protocol handler is removed.
   • !The parameter --output-decrypt-file-path (and its env var HELM_SECRETS_OUTPUT_DECRYPTED_FILE_PATH) is removed.
6. 3.14.0 Jun 6, 2022 · release notes

   helm-secrets v3.14.0 adds Windows support for vals and protocol handling with SOPS_GPG_EXEC env var

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.14.0 https://github.com/jkroepke/helm-secrets.git
   # already have the repo? check out this version:
   $ git checkout 3.14.0

   └──▷ USE IT
   Configure sops-gpg to use a specific GPG executable when running on Windows
   shell copy

   export SOPS_GPG_EXEC=/c/Program Files (x86)/GNU/GnuPG/pub/gpg.exe
   helm secrets decrypt values.yaml.enc

   Apply Windows-specific protocol patches required for sops integration to work on Windows environments
   shell copy

   helm secrets patch windows
   helm secrets decrypt values.yaml.enc

   • Adds vals support on Windows, enabling encrypted secret management via Vals expressions in Helm charts
   • Enables protocol handling on Windows requiring helm secrets patch windows command execution

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Defaults now prefer gpg4win over other GPG installations; use SOPS_GPG_EXEC=gpg to restore previous GPG binary selection behavior
7. 3.12.0 Feb 3, 2022 · release notes

   helm-secrets 3.12.0 adds Terraform integration and new env vars for value file path traversal security controls

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.12.0 https://github.com/jkroepke/helm-secrets.git
   # already have the repo? check out this version:
   $ git checkout 3.12.0

   • Adds HELM_SECRETS_VALUES_ALLOW_SYMLINKS environment variable to control whether symlinked value files are followed.
   • Adds HELM_SECRETS_VALUES_ALLOW_ABSOLUTE_PATH environment variable to control whether absolute value file paths are permitted.
   • Adds HELM_SECRETS_VALUES_ALLOW_PATH_TRAVERSAL environment variable to control whether dot-dot-slash (path traversal) value file paths are permitted.
   • Enables parsing of .netrc for HTTP-based values, overridable via the NETRC environment variable.

   4 details in Everything

8. 3.10.0 Nov 5, 2021 · release notes

   helm-secrets 3.10.0 adds age support for downloader plugin syntax

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.10.0 https://github.com/jkroepke/helm-secrets.git
   # already have the repo? check out this version:
   $ git checkout 3.10.0

9. 3.9.0 Oct 9, 2021 · release notes

   helm-secrets 3.9.0 adds gpg-import URI schemes and a vals driver for expanded secret source support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.9.0 https://github.com/jkroepke/helm-secrets.git
   # already have the repo? check out this version:
   $ git checkout 3.9.0

   • Supports secrets+gpg-import:// and secrets+gpg-import-kubernetes:// URI schemes to automatically import GPG keys from local paths or Kubernetes secrets.
   • Adds a [vals](https://github.com/variantdev/vals) driver, enabling access to Vault, AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution., GCP, sops, terraform states, and other file sources via the vals engine.

   2 details in Everything

10. 3.8.0 Jun 12, 2021 · release notes

    helm-secrets v3.8.0 adds --output-decrypt-file-path, HELM_SECRETS_DEC_PREFIX, and version subcommand

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.8.0 https://github.com/jkroepke/helm-secrets.git
    # already have the repo? check out this version:
    $ git checkout 3.8.0

    └──▷ USE IT
    Extract the path of a decrypted secrets file for piping into other commands without processing the file content itself.
    shell copy

    helm-secrets --output-decrypt-file-path deploy/secrets.yml
    # or
    export HELM_SECRETS_OUTPUT_DECRYPTED_FILE_PATH=1
    dec_path=$(helm-secrets decrypt deploy/secrets.yml)
    echo "Decrypted to: $dec_path"

    Check the installed version of helm-secrets in a script.
    shell copy

    helm-secrets --version

    • Adds --output-decrypt-file-path flag and HELM_SECRETS_OUTPUT_DECRYPTED_FILE_PATH environment variable to output only the path of decrypted files
    • Adds HELM_SECRETS_DEC_PREFIX environment variable for decrypted file naming in addition to existing suffix support
    • Adds --version subcommand to print version information

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default value of HELM_SECRETS_DEC_SUFFIX changed from .yaml.dec to .dec, so files no longer have the .yaml extension stripped before appending the suffix.
11. 3.6.0 Mar 29, 2021 · release notes

    helm-secrets 3.6.0 adds ArgoCDArgoCDA Kubernetes-native continuous delivery controller, maintained by the CNCF, that syncs live cluster state to declarative config stored in Git, giving cyber tools automated, auditable deployment pipelines. auto-detection via ARGOCD_APP_NAME and removes default sops dependency

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.6.0 https://github.com/jkroepke/helm-secrets.git
    # already have the repo? check out this version:
    $ git checkout 3.6.0

    • Sets HELM_SECRETS_QUIET=true by default when the ARGOCD_APP_NAME environment variable is present to detect ArgoCD environments.
    • Removes the bundled default installation of sops, allowing usage with HashiCorp Vault without requiring sops.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The tool no longer installs or uses sops by default, which breaks setups relying on the pre-installed sops binary for decryption.
12. 3.5.0 Feb 20, 2021 · release notes

    helm-secrets 3.5.0 adds --driver-args flag to pass extra arguments to the underlying secret driver

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.5.0 https://github.com/jkroepke/helm-secrets.git
    # already have the repo? check out this version:
    $ git checkout 3.5.0

    └──▷ TRY IT
    Pass custom environment variables or flags to the age or sops driver for advanced configuration.
    copy

    $ helm secrets install --driver-args '--env=AWS_REGION=us-east-1' my-release ./my-chart

13. 3.2.0 May 8, 2020 · release notes

    helm-secrets 3.2.0 adds Vault support and a generic secret driver for non-SOPS sources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.0 https://github.com/jkroepke/helm-secrets.git
    # already have the repo? check out this version:
    $ git checkout 3.2.0

    • Introduce a Secret driver architecture allowing secrets from sources other than SOPS

    1 detail in Everything

14. 3.1.0 Apr 27, 2020 · release notes

    helm-secrets 3.1.0 adds shell completion and a quiet flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.0 https://github.com/jkroepke/helm-secrets.git
    # already have the repo? check out this version:
    $ git checkout 3.1.0

    • Adds completion.yaml for helm shell auto-completion

    1 detail in Everything

15. 3.0.0 Apr 26, 2020 · release notes

    helm-secrets v3.0.0 adds POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. compatibility and optional temporary directory decryption.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.0 https://github.com/jkroepke/helm-secrets.git
    # already have the repo? check out this version:
    $ git checkout 3.0.0

    • Adds POSIX compatibility for broader shell support
    • Optionally decrypt helm secrets into a temporary directory
    • Support all helm subcommands and plugins

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Changed secrets.yaml prefix just to secrets. All files like secrets* are now decrypted