% gwsm 8
gwsm - interact with config map and secret manager variables
gwsm
Usage:
gwsm [GLOBAL OPTIONS] command [COMMAND OPTIONS] [ARGUMENTS...]
Secrets Manager commands w/ interactive interface
--binary, -b: get the SecretBinary value
display table of all secrets with meta data
print description of secret to STDOUT
--secret-id, -s="": Specific Secret to describe, will bypass select/search
select from list or pass in specific secret
--secret-id, -s="": Specific Secret to view, will bypass select/search
interactive edit of a secret String Value
--secret-id, -s="": Specific Secret to edit, will bypass select/search
create new secret in Secrets Manager
--description, -d="": Additional description text.
--interactive, -i: Open interactive editor to create secret value. If no 'value' is provided, an editor will be opened by default.
--secret-id, -s="": Secret name
--tags, -t="": key=value tags (CSV list)
--value, -v="": Secret Value. Will store as a string, unless binary flag is set.
non-interactive update to a specific secret
Stores a new encrypted secret value in the specified secret. To do this, the
operation creates a new version and attaches it to the secret. The version
can contain a new SecretString value or a new SecretBinary value.
This will put the value to AWSCURRENT and retain one previous version
with AWSPREVIOUS.
--interactive, -i: Override and open interactive editor to verify and modify the new secret value.
--secret-id, -s="": Secret name
--value, -v="": Secret Value. Will store as a string, unless binary flag is set.
delete a specific secret
--force, -f: Bypass recovery window (30 days) and immediately delete Secret.
--secret-id, -s="": Specific Secret to delete
Commands to interact with environment variables, both local and on cluster.
Print out detailed diff reports comparing local and running Pod
View diff of local vs. namespace
View the diff of the local environment against a given command running on a
pod within a namespace.
This will retrieve the stored secrets within AWS Secrets Manager and map them
via the secrets.yml file used by the 'summon' CLI tool to generate the current
state of Environment Variables for a given stage.
The AWS Secrets Manager names are assumed to be stored as
'<SECRETS_GROUP>_NAME' in the ConfigMap.
Example: 'RDS_SECRET_NAME: rds/staging/service-yolo'
From the root of the service, the required files are typically found below:
The path to the configmap.yaml file is within the kubernetes deployment.
This is typically .kube/<stage>/05-configmap.yaml
The path to the secrets.yml is typically .docker/secrets.yaml
It will then grab current environment for a specific process running within a
Pod in a given Namespace.
This is achieved by inspecting the /proc/<PID>/environ for the given process.
This method uses '/bin/bash -c' as the base command to perform the PID
inspection via 'ps faux'.
The 'filter-prefix' flag will exclude any values that start with the flagged
prefixes from display.
The 'exclude' flag will exclude any values where the KEY matches exactly from
display.
--cmd="": Command to inspect (default: node)
--configmap, -c="": Path to configmap.yaml
--exclude="": List (csv) of specific env vars to exclude values from display. Set to "" to remove any exclusions. (default: PATH,SHLVL,HOSTNAME)
--filter-prefix, -f="": List of prefixes (csv) used to filter values from display. Set to "" to remove any filters. (default: npm_,KUBERNETES_,API_PORT)
--namespace, -n="": Kube Namespace to list Pods from for inspection
--secret-suffix="": Suffix used to find ENV variables that denote the Secret Manager Secrets to lookup (default: _NAME)
--secrets, -s="": Path to secrets.yml (default: .docker/secrets.yml)
View diff of local (ansible encrypted) vs. namespace
View the diff of the local ansible-vault encrypted Kubernetes Secret file
against a given dotenv file on a pod within a namespace.
The local file will use the contents of the 'data.<accessor flag>' block.
This defaults to 'data..env'.
Supported ansible-vault encryption version: $ANSIBLE_VAULT;1.1;AES256
Example file structure of decrypted file:
---
apiVersion: v1
kind: Secret
type: Opaque
data:
.env: <BASE64 ENCODED STRING>
It will then grab contents of the dotenv file on a Pod in a given Namespace.
This defaults to inspecting the '$PWD/.env on' when executing a 'cat' command.
This method uses '/bin/bash -c' as the base command to perform inspection.
--accessor, -a="": Accessor key to pull data out of Data block. (default: .env)
--dotenv="": Path to .env file on Pod (default: $PWD/.env)
--encrypted-env-file, -e="": Path to encrypted Kube Secret file
--namespace, -n="": Kube Namespace list Pods from for inspection
--vault-password-file="": vault password file VAULT_PASSWORD_FILE
View configured environment for either local or running on a Pod
View env values based on local settings in a ConfigMap and secrets.yml
View the current environment variables for a given ConfigMap and summon
secrets.yml.
This will retrieve the stored secrets within AWS Secrets Manager and map them
via the secrets.yml file used by the 'summon' CLI tool to generate the current
state of Environment Variables for a given stage.
The AWS Secrets Manager names are assumed to be stored as
'<SECRETS_GROUP>_NAME' in the ConfigMap.
Example: 'RDS_SECRET_NAME: rds/staging/service-yolo'
From the root of the service, the required files are typically found below:
The path to the configmap.yaml file is within the kubernetes deployment.
This is typically .kube/<stage>/05-configmap.yaml
The path to the secrets.yml is typically .docker/secrets.yaml
The 'filter-prefix' flag will exclude any values that start with the flagged
prefixes from display.
--configmap, -c="": Path to configmap.yaml
--secret-suffix="": Suffix used to find ENV variables that denote the Secret Manager Secrets to lookup (default: _NAME)
--secrets, -s="": Path to secrets.yml (default: .docker/secrets.yml)
View env values from ansible-vault encrypted Secret file.
View a legacy ansible-vault encrypted Kubernetes Secret file. This will output
the contents of the 'data.<accessor flag>' block.
This defaults to 'data..env'.
Supported ansible-vault encryption version: $ANSIBLE_VAULT;1.1;AES256
Example file structure of decrypted file:
---
apiVersion: v1
kind: Secret
type: Opaque
data:
.env: <BASE64 ENCODED STRING>
--accessor, -a="": Accessor key to pull data out of Data block. (default: .env)
--encrypted-env-file, -e="": Path to encrypted Kube Secret file
--vault-password-file="": vault password file VAULT_PASSWORD_FILE
Interact with env on a running Pod within a Namespace
View the current environment for a specific process running within a Pod in a
given Namespace.
This is achieved by inspecting the /proc/<PID>/environ for the given process.
This method uses '/bin/bash -c' as the base command to perform the PID
inspection via 'ps faux'.
The 'filter-prefix' flag will exclude any values that start with the flagged
prefixes from display.
The 'exclude' flag will exclude any values where the KEY matches exactly from
display.
--cmd="": Command to inspect (default: node)
--exclude="": List (csv) of specific env vars to exclude values from display. Set to "" to remove any exclusions. (default: PATH,SHLVL,HOSTNAME)
--filter-prefix, -f="": List of prefixes (csv) used to filter values from display. Set to "" to remove any filters. (default: npm_,KUBERNETES_,API_PORT)
--namespace, -n="": Kube Namespace list Pods from
Dump environment for either local or running on a Pod to screen or file
Dump env values based on local settings in a ConfigMap and secrets.yml
Dump the current environment variables for a given ConfigMap and summon
secrets.yml.
This will retrieve the stored secrets within AWS Secrets Manager and map them
via the secrets.yml file used by the 'summon' CLI tool to generate the current
state of Environment Variables for a given stage.
The AWS Secrets Manager names are assumed to be stored as
'<SECRETS_GROUP>_NAME' in the ConfigMap.
Example: 'RDS_SECRET_NAME: rds/staging/service-yolo'
From the root of the service, the required files are typically found below:
The path to the configmap.yaml file is within the kubernetes deployment.
This is typically .kube/<stage>/05-configmap.yaml
The path to the secrets.yml is typically .docker/secrets.yaml
The 'filter-prefix' flag will exclude any values that start with the flagged
prefixes from display.
--configmap, -c="": Path to configmap.yaml
--secret-suffix="": Suffix used to find ENV variables that denote the Secret Manager Secrets to lookup (default: _NAME)
--secrets, -s="": Path to secrets.yml (default: .docker/secrets.yml)
Dump env values from ansible-vault encrypted Secret file.
Dump a legacy ansible-vault encrypted Kubernetes Secret file. This will output
the contents of the 'data.<accessor flag>' block.
This defaults to 'data..env'.
Supported ansible-vault encryption version: $ANSIBLE_VAULT;1.1;AES256
Example file structure of decrypted file:
---
apiVersion: v1
kind: Secret
type: Opaque
data:
.env: <BASE64 ENCODED STRING>
--encrypted-env-file, -e="": Path to encrypted Kube Secret file
--vault-password-file="": vault password file VAULT_PASSWORD_FILE
Dump env on a running Pod within a Namespace
Dump the current environment for a specific process running within a Pod in a
given Namespace.
This is achieved by inspecting the /proc/<PID>/environ for the given process.
This method uses '/bin/bash -c' as the base command to perform the PID
inspection via 'ps faux'.
The 'filter-prefix' flag will exclude any values that start with the flagged
prefixes from display.
The 'exclude' flag will exclude any values where the KEY matches exactly from
display.
--cmd="": Command to inspect (default: node)
--exclude="": List (csv) of specific env vars to exclude values from display. Set to "" to remove any exclusions. (default: PATH,SHLVL,HOSTNAME)
--filter-prefix, -f="": List of prefixes (csv) used to filter values from display. Set to "" to remove any filters. (default: npm_,KUBERNETES_,API_PORT)
--namespace, -n="": Kube Namespace list Pods from
simple S3 commands
[object path] [destination path]
The '[object path]' MUST always start with 's3://'
The '[destination path]' directory MUST exists, but file will be created or overwritten
Example:
$ gwsm s3 get s3://coll-bucket-name/with/path/filename /tmp/filename
Generate and install man page
NOTE: Windows is not supported
Print version info