diff --git a/secrets/README.md b/secrets/README.md index 0523673..9de2b67 100644 --- a/secrets/README.md +++ b/secrets/README.md @@ -1,5 +1,64 @@ # Secrets +## dynamic-opaque-jinja.j2 + +You can use this to create secrets in a more dynamic way including different namespaces and multiple key/value pairs. +The template will use a dict of the following format: +``` +secrets: + ns1: + secret1: + key1: value1 + key2: value2 + secret2: + key1: value1 + ... + ns2: + secret1: + key1: value1 + key2: value2 + ... +``` +Let's generate a secret from the above: +`ansible -i all -m template -a "src=dynamic-opaque-jinja.j2 dest=/tmp/secret.yml" -e $secrets` +The generated secret now looks like +```yaml +--- +apiVersion: v1 +kind: List +items: +- apiVersion: v1 + type: Opaque + data: + key1: dmFsdWUy + kind: Secret + metadata: + name: secret2 + namespace: ns1 +- apiVersion: v1 + type: Opaque + data: + key2: dmFsdWUy + key1: dmFsdWUx + kind: Secret + metadata: + name: secret1 + namespace: ns1 +--- +apiVersion: v1 +kind: List +items: +- apiVersion: v1 + type: Opaque + data: + key2: dmFsdWUy + key1: dmFsdWUy + kind: Secret + metadata: + name: secret1 + namespace: ns2 +``` + ## secret-docker-cfg.yml A way of creating a `.docker/config.json` secret where in the user is expected to precreate and base64 encode the `.docker/config.json` file. diff --git a/secrets/dynamic-opaque-jinja.j2 b/secrets/dynamic-opaque-jinja.j2 new file mode 100644 index 0000000..a2aa7af --- /dev/null +++ b/secrets/dynamic-opaque-jinja.j2 @@ -0,0 +1,18 @@ +{% for namespace, secret in secrets.items() %} +--- +apiVersion: v1 +kind: List +items: +{% for name, data in secret.items() %} +- apiVersion: v1 + type: Opaque + data: +{% for key, value in data.items() %} + {{ key }}: {{ value | b64encode }} +{% endfor %} + kind: Secret + metadata: + name: {{ name }} + namespace: {{ namespace }} +{% endfor %} +{% endfor %}