Implement Mozilla SOPS decryption

[stefanprodan]

This PR implements Mozilla SOPS decryption fix: #94

Example

In order to store secrets safely in a public or private Git repository, you can use Mozilla SOPS and encrypt your Kubernetes Secrets data with OpenPGP keys.

Generate a GPG key without passphrase using gnupg then use sops to encrypt a Kubernetes secret:

sops --pgp=FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 \
--encrypt --encrypted-regex '^(data|stringData)$' --in-place my-secret.yaml

Commit and push the encrypted file to Git.

Note that you should encrypt only the data section, encrypting the Kubernetes secret
metadata, kind or apiVersion is not supported by kustomize-controller.

Create a secret in the gitops-system namespace with the OpenPGP private key:

gpg --export-secret-keys --armor FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 |
kubectl -n gitops-system create secret generic sops-gpg \
--from-file=sops.asc=/dev/stdin 

Configure decryption by referring the private key secret:

apiVersion: kustomize.toolkit.fluxcd.io/v1alpha1
kind: Kustomization
metadata:
  name: my-secrets
spec:
  interval: 5m
  path: "./"
  sourceRef:
    kind: GitRepository
    name: my-secrets
  decryption:
    provider: sops
    secretRef:
      name: sops-pgp

[hiddeco]

This looks good to go to me for now. In a future iteration we should have a look at getting rid of the gpg binary as we now have full control over the process, and can now make it so that it does not have to fallback.

💯