add openssl

.woodpecker.yml

@@ -22,7 +22,7 @@ steps:
   build:
     image: plugins/kaniko
     settings:
-      repo: quay.io/wollud1969/k8s-admin-helper
+      repo: quay.io/wollud1969/woodpecker-helper
       registry: quay.io
       tags: 
         - latest

Dockerfile

@@ -1,4 +1,15 @@
 FROM alpine:latest
 
-RUN apk add --no-cache kubectl gpg
+ARG USER="user"
+
+RUN \
+    echo "@testing https://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories && \
+    apk add --no-cache kubectl openssl gpg gpg-agent bash trivy@testing curl helm && \
+    addgroup $USER && \
+    adduser -G $USER -D $USER
+
+COPY decrypt-secrets.sh /usr/local/bin/
+
+USER $USER
+WORKDIR /home/$USER
 

decrypt-secrets.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+#
+# Set the environment variable GPG_PASSPHRASE
+# Pipe the encrypted data and 
+#   - redirect the output into the destination file or
+#   - directly eval the output, in this case make sure ONLY variable definitions are in the file
+#
+# The second option would be
+#   eval "`cat secrets.asc | ./decrypt-secrets.sh`"
+#
+# To create the encrypted file use
+#   gpg --symmetric --cipher-algo AES256 --armor --output secrets.asc secrets.txt
+# where secrets.txt is the cleartext file and secrets.asc will be the encrypted file.
+# Make sure to use a good passphrase, make sure to store the passphrase safely.
+#
+# Adding the encrypted file secrets.asc to a source code repository is secure.
+#
+
+
+gpg --decrypt --passphrase $GPG_PASSPHRASE --yes --batch --homedir /tmp/.gnupg --output -