Harvest and Secrets Management with SOPs

Harvest and Secrets Management with SOPs

This is most applicable for 7-mode filers. When using cDOT, it's better to use ONTAP certificate authentication.

The idea outlined below is:

• Setup your harvest.yml per normal with username and passwords in the clear. Make sure everything works.
• Use sop to encrypt your harvest.yml file. Let's say the encrypted file is named harvest.enc.yml. Delete the in-the-clear file, harvest.yml.
• Use sop to start Harvest using the harvest.enc.yml

Setup

1. Install age
2. Install sops
3. Create key with age

age-keygen -o keys.txt

4. Print public key

grep public keys.txt

5. Move keys.txt to location sops requires

# Linux
mkdir -p $XDG_CONFIG_HOME/sops/age/
mv keys.txt $XDG_CONFIG_HOME/sops/age/

# Mac
mkdir -p ~/Library/Application\ Support/sops/age/
mv keys.txt ~/Library/Application\ Support/sops/age/

5. Encrypt harvest.yml

sops --encrypt --age public-key-from-step-4 harvest.yml > harvest.enc.yml

6. Start Harvest via sops

There are several ways to use the encrypted file. You can use an in-memory FIFO or temporary file. Both the examples below use --no-fifo

sops exec-file --no-fifo harvest.enc.yml 'HARVEST_CONFIG={} bin/harvest start'

# Launch a shell with the TMPFILE variable pointing to the decrypted harvest.yml
sops exec-file --no-fifo harvest.enc.yml 'TMPFILE={} bash'
    # now inside the exec-ed shell you can use harvest as normal with --config
bin/harvest --config $TMPFILE start|stop|status