-
Notifications
You must be signed in to change notification settings - Fork 9
/
kubectl-sh-secret
executable file
·147 lines (136 loc) · 3.71 KB
/
kubectl-sh-secret
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
#!/bin/bash
# kubectl-sh-secret (part of ossobv/vcutil) // wdoekes/2019 // Public Domain
#
# Helper script to manage opaque secrets. Usage through kubectl wrapper.
#
# Example:
#
# kubectl-sh-secret -n NAMESPACE get secrets SECRET KEY
#
# Or, the kubectl-wrapper wrapped version:
#
# kubectl -n NAMESPACE get secrets SECRET --sh-secret KEY
#
# That last version will enable tab-completion to work as usual.
#
test -z "${BASH_VERSION}" && echo "$0: requires bash" >&2 && exit 1
# Reorder arguments:
options=$(getopt -o n: -- "$@") || exit 1
eval set -- "$options"
while true; do
case "$1" in
-n) shift; namespace="$1";;
--) shift; break;;
esac
shift
done
# These arguments are needed for the kubectl-wrapper style to function:
arg_get="$1" # get
arg_secret="$2" # secret[s]
# The actual arguments:
secret="$3" # [SECRET]
key=$(echo "$4" | sed -e 's/[^A-Za-z0-9_.-]//') # [KEY]
key_esc=$(echo "$key" | sed -e 's/[.]/[.]/g') # escape allowed magic tokens
write="$5" # [write]
if [[ $# -gt 5 ]] || [[ "$arg_get" != "get" ]] ||
[[ "$arg_secret" != secret* ]] || (
[[ -n "$write" ]] && [[ "$write" != write ]] ); then
echo "Usage: $0 [-n NAMESPACE] get secret [SECRET [KEY [write]]]" >&2
exit 1
fi
# List all secrets:
list_secrets() {
kubectl_with_ns get secret
exit $?
}
# List secret blob:
# > data:
# > key1: base64value
# > key2: base64value
# > kind: Secret
list_secret() {
get_remote
echo "$keydata" | while read -r line; do
key1=${line%%: *}
base64value=${line#*: }
if [[ -z "$key" ]]; then
test -t 2 && printf "\x1b[1;34m[%s]\x1b[0m\n" "$key1" >&2 ||
echo "[$key1]" >&2
fi
echo "$base64value" | base64 -d
[[ -z "$key" ]] && echo >&2 # extra LF just in case
done
exit 0
}
# Update secret:
edit_secret() {
get_remote
get_local
fulldata2=$(echo "$fulldata" |
sed -e "s# $key_esc: .*# $key: $base64value#")
if [[ "$fulldata" == "$fulldata2" ]]; then
echo "No change?" >&2
exit 1
fi
diff -pu <(echo "$fulldata") <(echo "$fulldata2") # bashism
yn=
while true; do
echo >&2
echo -n "Commit [y/n]? " >&2
read yn < /dev/stdin
if [[ "$yn" == y ]]; then
break
elif [[ "$yn" == n ]]; then
echo >&2
echo "Aborted" >&2
exit 1
fi
done
echo >&2
echo "$fulldata2" | kubectl_with_ns apply -f - >&2
}
kubectl_with_ns() {
if [[ -z "$namespace" ]]; then
${KUBECTL:-kubectl} "$@"
else
${KUBECTL:-kubectl} -n "$namespace" "$@"
fi
}
get_remote() {
fulldata=$(kubectl_with_ns get secret -o yaml "$secret")
keydata=$(echo "$fulldata" |
sed -e '/^data:/,/kind: Secret/!d;/^data:/d;/^kind: Secret/d')
if [[ -z "$keydata" ]] ||
echo "$keydata" | grep -vE '^ [A-Za-z0-9_.-]+: ' | grep -q ''; then
echo "Unexpected data:" >&2
echo "\"$keydata\"" >&2
exit 1
fi
if [[ -n "$key" ]]; then
keydata=$(echo "$keydata" | grep "^ $key_esc: ")
if [[ -z "$keydata" ]]; then
echo "Key $key not found in secret $secret" >&2
exit 1
fi
fi
}
get_local() {
base64value=$(cat)
# If single-line, then drop trailing LF. If multi-line, then keep.
if [[ "$(echo -n "$base64value" | wc -l)" -eq 0 ]]; then
base64value=$(echo -n "$base64value" | base64 -w0)
else
base64value=$(echo "$base64value" | base64 -w0)
fi
if [[ -z "$base64value" ]]; then
echo "No input data; aborting" >&2
exit 1
fi
}
if [[ -z "$secret" ]]; then
list_secrets
elif [[ -z "$write" ]]; then
list_secret
else
edit_secret
fi