Generating K8s secrets with CUE

[cueckoo]

Originally opened by @jdstone-ig in cuelang/cue#414

We've started generating our K8s manifests using CUE and custom tooling, but we're not sure how to incorporate K8s secrets into our process.

What are everyone's thoughts on generating Kubernetes secrets with CUE?
EDIT: What are some approaches that others have taken in regards to generating Kubernetes secrets with CUE?

What are the official recommendations in regards to this from the CUE project?
EDIT: What are some recommendations or ideas in regards to this from CUE contributors?

[cueckoo]

Original reply by @verdverm in cuelang/cue#414 (comment)

I would say Cue (as a user / minor contributor) wouldn't really look to take a stance on that. Cue as a language does not have many concerns with how you apply it to a particular application or domain.

Now, given Cue's roots, there is a strong connection to the Go / k8s worlds, and has initial obvious and low hanging use cases in the configuration realm.

As an unofficial recommendation, I would say that how this is done is up to the tool and there will likely be a tool that emerges from Cueland to replace helm/terraform. (likely several, as I know there are several under development, and this will be something for the market to decide which one(s) prevail)

So this kind of thing likely belongs in tools built around Cue. The details of k8s is too specific of a concern for Cue.

One idea that does come to mind is a way to mark certain definitions, values, or fields as sensitive, such that when evaluating / printing, we can ellide these in the output.

[cueckoo]

Original reply by @jdstone-ig in cuelang/cue#414 (comment)

Great! Thanks for the input @verdverm!