Add a parameter resolver for EJSON wrapper#264
Conversation
stevehodgkiss
force-pushed
the
ejson_wrapper
branch
from
d2b12c8 to
25cbb66
Compare
patrobinson
left a comment
patrobinson
left a comment
There was a problem hiding this comment.
Tested and it works, minor question
|
|
||
| def secret_path_relative_to_base | ||
| @secret_path_relative_to_base ||= File.join('secrets', ejson_file) | ||
| end |
There was a problem hiding this comment.
These two methods have no effect and are not called anywhere? When I specify ejson_file I have to use the full path (secrets/foo.ejson)
There was a problem hiding this comment.
I've updated the resolver to look in secrets/ for the ejson_file
|
@stevehodgkiss I've added documentation, do you want to review that for me? |
|
|
||
| [ejson](https://github.com/Shopify/ejson) is a tool for managing asymmetrically encrypted values in JSON format. This allows you to keep secrets securely in git/Github and give anyone the ability the capability to add new secrets without requiring access to the private key. | ||
|
|
||
| First create the `production.ejson` file and store the secret value in it, then call `ejson encrypt secrets.ejson`. Then add the `ejson_file` argument to your stack in stack_master.yml: |
There was a problem hiding this comment.
Shall we provide details about how to create this file? For example:
ejson_wrapper generate --region ap-southeast-2 --kms-key-id [key_id] --file secrets/production.ejson
There was a problem hiding this comment.
We could add another command to stack master to create ejson files with ejson wrapper/a kms key rather than relying on the user to know about ejson wrapper and do this manually. Thoughts?
There was a problem hiding this comment.
Yeah I think that's a nice addition
|
|
||
| def resolve(secret_key) | ||
| validate_ejson_file_specified | ||
| secrets = decrypt_ejson_file |
5 participants
An EJSON file that uses KMS can be generated with EJSON Wrapper:
Secrets are then added as usual with EJSON. Add the plaintext then:
Set
ejson_filein the stack definition tostaging.ejson. Then secrets can be referenced in parameter files:TODO: