Updates Kubernetes Secrets with values from AWS Parameter Store

• Helm Chart (recommended): make {lint|install|purge}
• Go: make test && make build
• Docker: make container

First, export required variables, then run make install.

export AWS_REGION=<region>

Uses the default credential provider chain

The following chart values may be set. Only the required variables (AWS credentials) need provided by the user. Most of the time, the other defaults should work as-is.

The following app config values can be provided via environment variables or CLI flags. CLI flags take precdence over environment variables.

A KUBE_CONFIG and MASTER_URL are only necessary when running outside of the cluster (e.g., dev)

1. Create Parameter in AWS Parameter Store

my-db-password = foobar

2. Create Kubernetes Secret with Annotations

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
  annotations:
    aws-ssm/k8s-secret-name: my-secret
    aws-ssm/aws-param-name: my-db-password
    aws-ssm/aws-param-type: SecureString
data: {}

3. Run Binary

4. A key with the name $ParameterType should have been added to your Secret

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
  annotations:
    aws-ssm/k8s-secret-name: my-secret
    aws-ssm/aws-param-name: my-db-password
    aws-ssm/aws-param-type: SecureString
data:
  SecureString: Zm9vYmFyCg==

Values for aws-ssm/aws-param-type are:

make           # Build binary
make container # Build Docker image
make push      # Push Docker image

For ease of use, the ca-certificates package is installed on the final library/alpine image. If you're having SSL/TLS connection issues, export HOST_SSL_DIR=/etc/ssl/certs before running make install. This will mount the SSL cert directory on the EC2 instance.

docker buildx create --use
docker buildx build --platform linux/amd64,linux/arm64,linux/arm/v7 . -t 626314663667.dkr.ecr.us-west-2.amazonaws.com/aws-ssm:arm64 --push