diff --git a/README.md b/README.md index 0977646e..3553f9f6 100644 --- a/README.md +++ b/README.md @@ -14,10 +14,10 @@ ## About -helm-secrets is a Helm plugin for decrypt encrypted Helm **value files** on the fly. +helm-secrets is a Helm plugin to decrypt encrypted Helm **value files** on the fly. -* Use [sops](https://github.com/getsops/sops) to encrypt value files and store them into git. -* Store your secrets a cloud native secret manager like AWS SecretManager, Azure KeyVault or HashiCorp Vault and inject them inside value files or templates. +* Use [sops](https://github.com/getsops/sops) to encrypt value files and store them in git. +* Store your secrets in a cloud native secret manager like AWS SecretManager, Azure KeyVault or HashiCorp Vault and inject them inside value files or templates. * Use helm-secret in your favorite deployment tool or GitOps Operator like ArgoCD Who’s actually using helm-secrets? If you are using helm-secrets in your company or organization, we would like to invite you to create a PR to add your @@ -34,7 +34,7 @@ For full documentation, read [GitHub wiki](https://github.com/jkroepke/helm-secr ### Decrypt secrets via protocol handler Run decrypted command on specific value files. -This is method is preferred over the plugin command below. +This method is preferred over the plugin command below. This mode is used in [ArgoCD](https://github.com/jkroepke/helm-secrets/wiki/ArgoCD-Integration) environments. On Windows, the command `helm secrets patch windows` needs to be run first. @@ -47,7 +47,7 @@ See [Usage](https://github.com/jkroepke/helm-secrets/wiki/Usage) for more inform ### Decrypt secrets via plugin command -Wraps the whole `helm` command. Slow on multiple value files. +Wraps the whole `helm` command. Slow on multiple value files. ```bash helm secrets upgrade name . -f secrets.yaml @@ -58,8 +58,7 @@ helm secrets upgrade name . -f secrets.yaml *requires helm 3.9+; vals 0.20+* -helm-secrets supports evaluating [vals](https://github.com/variantdev/vals) expressions inside Helm templates by -enable the flag `--evaluate-templates`. +helm-secrets supports evaluating [vals](https://github.com/variantdev/vals) expressions inside Helm templates with the flag `--evaluate-templates`. **secrets.yaml** @@ -140,7 +139,7 @@ resource "helm_release" "example" { } ``` -An example of how to use helm-secrets with Terraform could be found in [examples/terraform](examples/terraform/helm.tf). +An example of how to use helm-secrets with Terraform can be found in [examples/terraform](examples/terraform/helm.tf). ## Secret backends @@ -151,7 +150,7 @@ See [Secret-Backends](https://github.com/jkroepke/helm-secrets/wiki/Secret-Backe ## Documentation -An additional documentation, resources and examples can be found [here](https://github.com/jkroepke/helm-secrets/wiki/Usage). +Additional documentation, resources and examples can be found [here](https://github.com/jkroepke/helm-secrets/wiki/Usage). ## Moving parts of project @@ -160,7 +159,7 @@ An additional documentation, resources and examples can be found [here](https:// - [`scripts/commands`](scripts/commands) - Sub Commands of `helm secrets` are defined here. - [`scripts/lib`](scripts/lib) - Common functions used by `helm secrets`. - [`scripts/wrapper`](scripts/wrapper) - Wrapper scripts for Windows systems. -- [`tests`](tests) - Test scripts to check if all parts of the plugin work. Using test assets with PGP keys to make real tests on real data with real encryption/decryption. See [`tests/README.md`](tests/README.md) for more informations. +- [`tests`](tests) - Test scripts to check if all parts of the plugin work. Using test assets with PGP keys to make real tests on real data with real encryption/decryption. See [`tests/README.md`](tests/README.md) for more information. - [`examples`](examples) - Some example secrets.yaml ## Copyright and license diff --git a/docs/ArgoCD Integration.md b/docs/ArgoCD Integration.md index 954daa2c..c8067b6a 100644 --- a/docs/ArgoCD Integration.md +++ b/docs/ArgoCD Integration.md @@ -7,7 +7,7 @@ Since ArgoCD is a shared environment, consider reading [Security in shared environments](https://github.com/jkroepke/helm-secrets/wiki/Security-in-shared-environments) to prevent users from reading files outside the own directory. -➡ With helm-secrets, you can encrypt value files only. Encypted manifests/templates are not supported. +➡ With helm-secrets, you can encrypt value files only. Encrypted manifests/templates are not supported. # Prerequisites @@ -77,18 +77,18 @@ References: * https://github.com/argoproj/argo-cd/issues/11866 * https://github.com/argoproj/argo-cd/pull/11966 -On ArgoCD 2.6.x, helm-secrets isn't supported in Multi-Source application, because the source reference, e.g.: `$ref` needs to be at the beginn of a string. -This is in conflict with helm-secrets, since the string needs to beginn with `secrets://`. On top, ArgoCD do not resolve references in URLs. +On ArgoCD 2.6.x, helm-secrets isn't supported in Multi-Source application, because the source reference, e.g.: `$ref` needs to be at the beginning of a string. +This is in conflict with helm-secrets, since the string needs to begin with `secrets://`. On top, ArgoCD do not resolve references in URLs. `HELM_SECRETS_VALUES_ALLOW_ABSOLUTE_PATH` must be set to `true`, since ArgoCD pass value files with absolute file path. Ensure that the env `HELM_SECRETS_WRAPPER_ENABLED=true` (default `false`) and `HELM_SECRETS_VALUES_ALLOW_ABSOLUTE_PATH=true` is set on the argocd-repo-server. -Please ensure you are following the lastest installation instructions (updated on 2023-03-03). +Please ensure you are following the latest installation instructions (updated on 2023-03-03). ### sops backend -If you are using `sops` backend, you have to [mounte](#method-1--mount-the-private-key-from-a-kubernetes-secret-as-volume-on-the-argocd-repo-server) +If you are using `sops` backend, you have to [mount](#method-1--mount-the-private-key-from-a-kubernetes-secret-as-volume-on-the-argocd-repo-server) the gpg keys on the `argocd-repo-server` and additionally define the environment variable `HELM_SECRETS_LOAD_GPG_KEYS` with the path of gpg key as values. Read more about mounting gpg keys [here](#method-1--mount-the-private-key-from-a-kubernetes-secret-as-volume-on-the-argocd-repo-server) diff --git a/docs/Feature Flags.md b/docs/Feature Flags.md index 04179404..49521049 100644 --- a/docs/Feature Flags.md +++ b/docs/Feature Flags.md @@ -16,4 +16,4 @@ In this case, `GITHUB_TOKEN` will be substituted with an environment variable na Some environment like ArgoCD do the same, but with an [limited](https://argo-cd.readthedocs.io/en/stable/user-guide/build-environment/) subset of environment variables. -In such situations, the `$` needs escaped to prevent evalution in environments. For ArgoCD, it's an additional dolar sign like `$${GITHUB_TOKEN}`. Other environments are working with back-slash like `\${GITHUB_TOKEN}` +In such situations, the `$` needs escaped to prevent evaluation in environments. For ArgoCD, it's an additional dollar sign like `$${GITHUB_TOKEN}`. Other environments are working with back-slash like `\${GITHUB_TOKEN}` diff --git a/tests/README.md b/tests/README.md index e22e1bef..20485bff 100644 --- a/tests/README.md +++ b/tests/README.md @@ -122,7 +122,7 @@ HELM_SECRETS_BACKEND=vault bats -r tests/unit HELM_SECRETS_BACKEND=vault bats -r tests/it ``` -The vault tests require a reachable vault server. Start one on you local machine by run: +The vault tests require a reachable vault server. Start one on your local machine by running: ```bash vault server -dev -dev-root-token-id=test