Add git-secret support

[arsiesys]

Hello,

To answer to some needs, I made a change to handle the git repository using git-secret. This allow us to encrypt our secrets.
https://git-secret.io/

If the parameter --git-secret is set to true in fluxd configuration and a .gitsecret directory exist in the root of the git, flux will execute a "git secret reveal -f" in the working git.
Indeed, to make it work, you need to have the key in the gpg keystore, that's why we are using the --git-gpg-key-import option for that. Happy it was already there.

I am not fully comfortable with GO, so I am open to any suggestion that could be easily applied on my changes. For any more complicated changes, please take the handover on this PR if you are really interested or give me good clues :p.

Related Issues:
#1676

[hiddeco]

Awesome to see how this benefits from the initial work for GPG signatures, and a sought after feature! 🎖️

Please take a look at my (minor) comments.

[arsiesys]

Awesome to see how this benefits from the initial work for GPG signatures, and a sought after feature! medal_military

Please take a look at my (minor) comments.

Thanks for your comments, I applied your recommendations! :)

[hiddeco]

One small suggestion, and can you please add the new flag to the daemon documentation?

[aarnaud]

Nice, I hope we will have this feature in the next release

[hiddeco]

@arsiesys couple of days have gone by since the last review, are you still planning to incorporate the feedback from Stefan and Michael?

[arsiesys]

Hello, yes, I will. A bit lack of time to do that lately ! 😬

[hiddeco]

@arsiesys no worries, if it does not fit your schedule right now I'd be happy to make the adjustments. Just let me know.

[squaremo]

Nice work @arsiesys !

[davidkarlsen]

@stefanprodan should the chart be updated too? What do you need for it - simply a flag to activate --git-secret ?

[stefanprodan]

@davidkarlsen for experimental features there is an additional flag in the chart: https://github.com/fluxcd/flux/blob/master/chart/flux/values.yaml#L265

[hardvintage]

Can i ask a question here...
I enabled the options:

- --git-secret=true
- --git-gpg-key-import=/root/.gpg/

Imported successfully

ts=2020-09-07T12:21:22.416999372Z caller=main.go:347 info="imported GPG key(s) from /root/.gpg/" files=[xxx.gpg]

Get ERROR

ts=2020-09-07T12:17:56.882295512Z caller=images.go:17 component=sync-loop msg="polling for new images for automated workloads"
ts=2020-09-07T12:17:56.973595547Z caller=images.go:23 component=sync-loop error="getting unlocked automated resources: git secret reveal -f: gpg: decryption failed: No secret key\ngit-secret: abort: problem decrypting file with gpg: exit code 2: /tmp/flux-working161304987/xxx/xxx/xxx/config/local.json\n"

When open a shell of the pod , i can import the gpg key and do git reveal, could anybody help?