tdmalone/aws-ssm repository overview

⁠cmattoon/aws-ssm

Updates Kubernetes Secrets with values from AWS Parameter Store

⁠Build Options

• Helm Chart (recommended): make {lint|install|purge}
• Go: make test && make build
• Docker: make container

⁠Helm Chart

⁠Install Helm Chart

First, export required variables, then run make install.

export AWS_REGION=<region>

⁠AWS Credentials

Uses the default credential provider chain⁠

⁠Values

The following chart values may be set. Only the required variables (AWS credentials) need provided by the user. Most of the time, the other defaults should work as-is.

⁠Configuration

The following app config values can be provided via environment variables or CLI flags. CLI flags take precdence over environment variables.

A KUBE_CONFIG and MASTER_URL are only necessary when running outside of the cluster (e.g., dev)

⁠Basic Usage

1. Create Parameter in AWS Parameter Store

my-db-password = foobar

1. Create Kubernetes Secret with Annotations

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
  annotations:
    aws-ssm/k8s-secret-name: my-secret
    aws-ssm/aws-param-name: my-db-password
    aws-ssm/aws-param-type: SecureString
data: {}

1. Run Binary

2. A key with the name $ParameterType should have been added to your Secret

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
  annotations:
    aws-ssm/k8s-secret-name: my-secret
    aws-ssm/aws-param-name: my-db-password
    aws-ssm/aws-param-type: SecureString
data:
  SecureString: Zm9vYmFyCg==

⁠Annotations

⁠AWS Parameter Types

Values for aws-ssm/aws-param-type are:

⁠Build

make           # Build binary
make container # Build Docker image
make push      # Push Docker image

⁠CA Certificates

For ease of use, the ca-certificates package is installed on the final library/alpine image. If you're having SSL/TLS connection issues, export HOST_SSL_DIR=/etc/ssl/certs before running make install. This will mount the SSL cert directory on the EC2 instance.