SOPS integration
@@ -4,10 +4,13 @@ import (
"archive/tar"
"bytes"
"compress/gzip"
+ "fmt"
"io"
"time"
"github.com/rancher/fleet/pkg/content"
+ "go.mozilla.org/sops/v3"
+ "go.mozilla.org/sops/v3/decrypt"
)
func (m *Manifest) ToTarGZ() (io.Reader, error) {
@@ -20,6 +23,12 @@ func (m *Manifest) ToTarGZ() (io.Reader, error) {
if err != nil {
return nil, err
}
+
+ bytes, err = decryptSOPS(bytes)
+ if err != nil {
+ return nil, err
+ }
+
if err := w.WriteHeader(&tar.Header{
Name: resource.Name,
Mode: 0644,
@@ -41,3 +50,17 @@ func (m *Manifest) ToTarGZ() (io.Reader, error) {
return buf, gz.Close()
}
+
+func decryptSOPS(data []byte) ([]byte, error) {
+ if !bytes.Contains(data, []byte("sops:")) {
+ return data, nil
+ }
+
+ clearText, err := decrypt.Data(data, "yaml")
+ if err == sops.MetadataNotFound {
+ return data, nil
+ } else if err != nil {
+ return data, fmt.Errorf("failed to decrypt with sops: %w", err)
+ }
+ return clearText, nil
+}
