https://pulumi.com logo
Title
b

breezy-gold-44713

04/07/2020, 11:59 PM
How can I emulate this via pulumi from pulumi config secrets?
kubectl create secret tls myservice-tls --cert=myservice.cert.pem --key=myservice.key.pem --dry-run -o yaml
. I’ve tried manually constructing a TLS secret with the exact contents of the yaml file, but it doesn’t work for some reason. I feel like I must be missing something obvious, any insights?
b

billowy-army-68599

04/08/2020, 12:10 AM
You can read the file from disk using whatever library makes sense, in typescript:
const secret = new k8s.core.v1.Secret("secret", {
    stringData: { 
        "tls.crt": fs.readFileSync("myservice.cert.pem").toString(),
        "tls.key": fs.readFileSync("myservice.key.pem").toString(),
    },
});
b

breezy-gold-44713

04/08/2020, 12:15 AM
Yes, but if I want to store them in the pulumi stack so it can be encrypted?
It’s not possible for me to store the key in revision control, so I need to stash it in the stack in an encrypted format
I can cobble together a secret of type “tls” that has the exact same base64 values read from the stack that I see in the yaml file output from the kubectl command, but they are clearly different somehow when I go to actually use the secret
g

gorgeous-egg-16927

04/08/2020, 2:49 AM
The “stringData” field is base64 encoded server-side. If you’re passing in base64 encoded data, you can use the “data” field instead.
b

breezy-gold-44713

04/08/2020, 7:40 PM
OK, I got this working! I’m going to document my solution here for future reference
$ base64 < myservice.cert.pem | pulumi config set --secret tls.crt
$ base64 < myservice.key.pem | pulumi config set --secret tls.key
const secretsName = `${serviceName}-secrets`;
const secrets = new k8s.core.v1.Secret(secretsName, {
    metadata: {
        name: secretsName,
        namespace: "mynamespace"
    },
    type: "<http://kubernetes.io/tls|kubernetes.io/tls>",
    data: {
        "tls.crt" : Buffer.from(config.require("tls.crt")).toString(),
        "tls.key" : Buffer.from(config.require("tls.key")).toString(),
    },
});
🎉 2