Integration with sops

[zephyros-dev]

Tanka already support importing a json/yaml file, so I wonder if a similar integration can be made with sops encrypted file?

[lukasmrtvy]

i would suggest something like:
tk apply --yaml-vars=<(sops -d secrets.enc.yaml)
or from stdin ( that can work for linux, mac, powershell )
sops -d secrets.enc.yaml | tk apply --yaml-vars -

[Duologic]

Piping it in with top-level arguments seems to work pretty well:

[I] ➜ cat environments/default/main.jsonnet
function(secrets) {
  secrets: secrets,
}

[I] ➜ cat secrets.json
{
    "password": "supersecret"
}

[I] ➜ cat secrets.json | tk eval --tla-code "secrets=import '/dev/stdin'" environments/default/main.jsonnet
{
  "secrets": {
    "password": "supersecret"
  }
}

[Duologic]

cat secrets.json can be the sops -d secrets.enc.json for example.

[zephyros-dev]

The same can be done with yaml file:

# cat environments/default/main.jsonnet
function(secret_yaml) {
  secrets: std.native('parseYaml')(secret_yaml),
}
# sops -d secret.sops.yaml
secret: very_secret
# sops -d secret.sops.yaml | tk eval --tla-code "secret_yaml=importstr '/dev/stdin'" environments/default/main.jsonnet
{
  "secrets": [
    {
      "secret": "very_secret"
    }
  ]
}

[zephyros-dev]

I see that there's some workaround here, but it's a bit unwieldy, and decrypting multiple files would not be easy to automate. sops already have a Go decrypt package, so an ideal integration I can think of would be done using native function, something like:

{
  someField:  std.native('sopsDecrypt')(importstr 'secret.sops.yaml'),
}

[zephyros-dev]

I made a sample gist for using tanka with encrypted sops yaml files here. The name of the sops files is hardcoded at the moment however.