<p>I am in the learning phase of kubernetes and able to set up deployments, services etc. However I have got stuck on how to manage secrets.</p>
<p>Context</p>
<ol>
<li><p>I am using GKE for Kubernetes cluster</p>
</li>
<li><p>I am using helm charts for managing all deployment operations</p>
</li>
<li><p>I have created a google service account that has access to say google cloud storage.</p>
</li>
</ol>
<p>My application uses the helm to create deployments and services, however, how do I manage the google service account creds I have created in an automated way like</p>
<ol>
<li><p>I do not want to create the secrets manually like this - <code>kubectl create secret generic pubsub-key --from-file=key.json=PATH-TO-KEY-FILE.json</code> ,
I want to do it through helm because say tomorrow if I move to another k8s cluster then I have do it manually again</p>
</li>
<li><p>Is there anyway to push my helm charts to repos without concerning of exposing my secrets as plain objects.</p>
</li>
</ol>
<p>Apart from this, any other guidelines and best practices would be really helpful.</p>

<blockquote>
<p>I do not want to create the secrets manually like this - kubectl
create secret generic pubsub-key
--from-file=key.json=PATH-TO-KEY-FILE.json , I want to do it through helm because say tomorrow if I move to another k8s cluster then I have
do it manually again</p>
</blockquote>
<p>You can create the <strong>secret</strong> template to helm which will create the secret for you, at run time of helm time.</p>
<p>You helm will find the <code>service account.json</code> and create the secret based on that.</p>
<p>For example <strong>service-account.yaml</strong></p>
<pre><code>{{- $all := . -}}
{{ range $name, $secret := .Values.serviceAccountSecrets }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $name }}
  labels:
    app: {{ $name }}
    chart: {{ template &quot;atlantis.chart&quot; $all }}
    component: service-account-secret
    heritage: {{ $all.Release.Service }}
    release: {{ $all.Release.Name }}
data:
  service-account.json: {{ $secret }}
---
{{ end }}
</code></pre>
<p><strong>values.yaml</strong></p>
<pre><code>serviceAccountSecrets:
  # credentials: &lt;json file as base64 encoded string&gt;
  # credentials-staging: &lt;json file as base64 encoded string&gt;
</code></pre>
<p>Or else you can use this GCP service account controller which creates the <strong>Serviceaccount</strong> and the <strong>secret</strong> for you.</p>
<p><a href="https://github.com/kiwigrid/gcp-serviceaccount-controller" rel="nofollow noreferrer">https://github.com/kiwigrid/gcp-serviceaccount-controller</a></p>
<blockquote>
<p>Is there anyway to push my helm charts to repos without concerning of
exposing my secrets as plain objects.</p>
</blockquote>
<p>For committing issues you can use the <code>.helmignore</code> file.</p>
<p>Read more at : <a href="https://helm.sh/docs/chart_template_guide/helm_ignore_file/" rel="nofollow noreferrer">https://helm.sh/docs/chart_template_guide/helm_ignore_file/</a></p>
<p>So inside the GIT, you have to commit only <code>values.yaml</code> not <code>values-dev.yaml</code>, <code>values-stag.yaml</code></p>
