helm secrets with age

[gerardcl]

Fixes #293

Tasks:

• Updated design documents in docs/design directory or not applicable
• Updated user-facing documentation in docs directory or not applicable
• Ran tests (e.g. make test) or not applicable
• Updated changelog or not applicable

[gerardcl]

first commit with changes on the Dockerfile.helm file -> helm-secrets to latest version, add sops and age explicitly
missing: docs update (followup from #292), change wherever pgp is used to age (secrets in tests, etc), something else?

@michaelsauter is this first commit ok? I did this way since we only want the binaries at the end...

[michaelsauter]

Yep, that looks about right. Keep in mind that this commit should also update https://github.com/opendevstack/ods-pipeline/blob/master/docs/design/software-design-specification.adoc. That document tracks what gets installed and in which version.

[gerardcl]

@michaelsauter from what I have understood, until now we had kinda not mandatory having the helm-private-key-secret in place in the tests and so on, but it looks that anyhow it is required by design, or am I wrong? Do we make it required so the tests do not fail in the case it is not existing (by making it always to exist)? or we should keep it being not mandatory?

[michaelsauter]

@gerardcl See https://github.com/opendevstack/ods-pipeline/blob/master/test/tasks/ods-deploy-helm_test.go#L62. That sets up the private key. I think you need to exchange that for age.

[gerardcl]

@michaelsauter I thought about that but was not sure, so in this case I understand instead of importing via executing gpg import I will need to make it available in the context env when executing helm command. ok! let's see!

[gerardcl]

@renedupont I updated user docs from your update (added multiple recipients note) and updated related part on admin installation too 👍

[gerardcl]

that is under construction still, that comment there explains the current approach just for the task in here:

ods-pipeline/deploy/central/tasks-chart/templates/task-ods-deploy-helm.yaml

Line 77 in 4d895db

- name: SOPS_AGE_KEY_FILE

anyhow, I am not sure if that will be the final approach yet

[gerardcl]

@michaelsauter ready for review 👍

[henrjk]

This looks good to me. Note that I did not actually try it out though.

[michaelsauter]

Awesome! This looks really good. Thanks!

I had a few nitpicks (sorry!), and wanted to ask if you could also update docs/design/software-design-specification.adoc? It would be good to record the updated versions and add a new software item for age.

[michaelsauter]

👌