FluxCD gather secrets from external secret manager

[jprecuch]

We are currently testing FluxCD POC we might consider deploying for our helmcharts. However we are not able to find out any handy way to fetch secrets from GCP/AWS Secret manager to FluxCD.

Does FluxCD recommend some tools to be used to perform this or we need to build some github actions steps to do this instead?
Every information that can help us to put to proper path is very welcome.
These secrets would be used as values.yaml
Thanks

[stefanprodan]

Flux has native support for SOPS, you can use SOPS the CLI to encrypt secrets using KMS (GPC/AWS) and then configure Flux to decrypt them in-cluster. Docs here: https://fluxcd.io/docs/guides/mozilla-sops/

[jprecuch]

@stefanprodan Thanks but that's how to encrypt secrets. What we are trying to achieve is:

1. We have password for database stored in Google Secret Manager
2. We want FluxCD to fetch this secret (not encode using this secret)
3. After it fetched this secret it will be used as valuesFrom reference

All I could find with SOPS was it encodes files using KMS. But we have secrets not in file but in Secret Manager
Anything we can use for that?

For example with other tool we could use vals https://github.com/variantdev/vals + helm-secrets plugin. However not sure if vals is somehow possible to be used with FluxCD

[stefanprodan]

This is not possible with Flux, we don't support Helm plugins.

[jprecuch]

Thanks @stefanprodan we will try to figure it out somehow to suit our needs