Skip to main content
Version: Weekly Build

Encrypt the Secrets and Configure DNS

Before you start​

config.yaml and prod.vault.yaml should already be generated and reviewed, as described in Prepare the jumpbox and generate the configuration.

Encrypt and place the secrets​

Generate an age identity on the jumpbox and make it readable only by root:

age-keygen -o /etc/codesphere/secrets/age_key.txt
chmod 0600 /etc/codesphere/secrets/age_key.txt

Copy the generated files to the jumpbox, then encrypt the vault there:

install -m 0600 config.yaml /etc/codesphere/config.yaml
install -m 0600 prod.vault.yaml /etc/codesphere/secrets/prod.vault.yaml

sops --encrypt --in-place \
  --age "$(age-keygen -y /etc/codesphere/secrets/age_key.txt)" \
  /etc/codesphere/secrets/prod.vault.yaml

Back up config.yaml, the encrypted vault, and the age identity to an approved secret store. The age identity is required to recover or update the installation. Never commit the plaintext vault or age identity to source control.

Re-editing an encrypted vault​

To edit the encrypted prod.vault.yaml later, point SOPS_AGE_KEY_FILE at your age identity and open the file with sops directly — it decrypts, opens your editor, and re-encrypts on save:

export SOPS_AGE_KEY_FILE=/etc/codesphere/secrets/age_key.txt
sops /etc/codesphere/secrets/prod.vault.yaml

warning

If you need to change prod.vault.yaml after the installer has run once, apply the change directly to the file on the jumpbox. The installer adds its own generated secrets to the vault at runtime, so replacing the file wholesale from an older local copy would discard them.

Configure DNS​

Create these records after the three stable addresses are allocated:

RecordKubernetes serviceTarget
<base-domain>gateway-controllerPlatform gateway IP
<dc-id>.<base-domain>gateway-controllerPlatform gateway IP
*.<dc-id>.<base-domain>public-gateway-controllerWorkspace gateway IP
<dc-id>.ssh.<base-domain>ssh-workspace-proxyWorkspace SSH proxy IP

Use a short TTL such as 300 seconds during initial setup. Depending on the DNS provider and network design, the records may be A/AAAA, alias, or load-balancer records. Ensure the certificate solver can update DNS when using DNS-01, or that TCP 80 reaches the platform gateway when using HTTP-01. See Cluster ingress CA options for certificate issuer configuration.

Some cloud-controller and load-balancer integrations assign external IP addresses only after Kubernetes and the provider integration are running. If the three addresses are not known yet, defer creating and verifying these records until Complete the infrastructure integration, then return to this table with the assigned addresses. Otherwise, verify every record from outside the private network before continuing.

What you should have now​

  • config.yaml and the encrypted prod.vault.yaml in place on the jumpbox, with the age identity backed up separately.
  • DNS records created (or explicitly deferred) for the platform gateway, workspace gateway, and workspace SSH proxy.

Next​

Continue to Run the installer.