kubectl-sh-secret

#!/bin/bash
# kubectl-sh-secret (part of ossobv/vcutil) // wdoekes/2019,2024
#   // Public Domain
#
# Helper script to manage opaque secrets. Usage through kubectl wrapper.
#
# Example:
#
#   kubectl-sh-secret -n NAMESPACE get secrets SECRET KEY
#
# Or, the kubectl-wrapper wrapped version:
#
#   kubectl -n NAMESPACE get secrets SECRET --sh-secret KEY
#
# That last version will enable tab-completion to work as usual.
#
set -eu
test -z "${BASH_VERSION}" && echo "$0: requires bash" >&2 && exit 1

# Reorder arguments:
options=$(getopt -l export -o n: -- "$@") || exit 1
is_export=false
eval set -- "$options"
while true; do
    case "${1:-}" in
    --export) is_export=true;;
    -n) shift; namespace="$1";;
    --) shift; break;;
    *) echo "$0: programming error? $1" >&2; exit 1
    esac
    shift
done

# These arguments are needed for the kubectl-wrapper style to function:
arg_get="$1"        # get
arg_secret="${2:-}" # secret[s]

# The actual arguments:
secret="${3:-}"     # [SECRET]
key=$(echo "${4:-}" | sed -e 's/[^A-Za-z0-9_.-]//')  # [KEY]
key_esc=$(echo "$key" | sed -e 's/[.]/[.]/g')  # escape allowed magic tokens
write="${5:-}"      # [write]

if [[ $# -gt 5 ]] || [[ "$arg_get" != "get" ]] ||
        [[ "$arg_secret" != secret* ]] || (
        [[ -n "$write" ]] && [[ "$write" != write ]] ); then
    echo "Usage: $0 [-n NAMESPACE] get secret [SECRET [KEY [write]]]" >&2
    exit 1
fi

# List all secrets:
list_secrets() {
    kubectl_with_ns get secret
    exit $?
}

# List secret blob:
# > data:
# >   key1: base64value
# >   key2: base64value
# > kind: Secret
list_secret() {
    get_remote
    echo "$keydata" | while read -r line; do
        key1=${line%%: *}
        base64value=${line#*: }
        if [[ -z "$key" ]]; then
            test -t 2 && printf "\x1b[1;34m[%s]\x1b[0m\n" "$key1" >&2 ||
                echo "[$key1]" >&2
        fi
        echo "$base64value" | base64 -d
        [[ -z "$key" ]] && echo >&2  # extra LF just in case
    done
    exit 0
}

# Show secret with stringdata for easy copy/paste:
export_secret() {
    get_remote
    echo 'apiVersion: v1'
    echo 'kind: Secret'
    echo 'metadata:'
    if [[ -n "$namespace" ]]; then
        echo "  namespace: $namespace"
    fi
    echo "  name: $secret"
    echo 'stringData:'
    echo "$keydata" | while read -r line; do
        key1=${line%%: *}
        base64value=${line#*: }
        value=$(echo "$base64value" | base64 -d)
        lfs=$(printf '%s' "$value" | wc -l)
        if [[ $lfs == 0 && $value != *\"* && $value != *\\* ]]; then
            # Always make it a string (fixing numbers). Works if there are
            # no quotes or backslashes to mess us up.
            echo "  $key1: \"$value\""
        else
            # >   |    "clip"   keep one LF at the end
            # >-  |-   "strip"  remove all LFs/blanks at the end
            # >+  |+   "keep"   keep trailing WS
            echo "  $key1: |"
            # We can safely add an extra LF here, it will be clipped.
            printf '%s\n' "$value" | sed -e 's/^/    /'
        fi
    done
    echo "type: $keytype"
    exit 0
}

# Update secret:
edit_secret() {
    get_remote
    get_local
    fulldata2=$(echo "$fulldata" |
                sed -e "s#  $key_esc: .*#  $key: $base64value#")
    if [[ "$fulldata" == "$fulldata2" ]]; then
        echo "No change?" >&2
        exit 1
    fi
    diff -pu <(echo "$fulldata") <(echo "$fulldata2") || true  # bashism
    yn=
    while true; do 
        echo >&2
        echo -n "Commit [y/n]? " >&2
        read yn < /dev/stdin
        if [[ "$yn" == y ]]; then
            break
        elif [[ "$yn" == n ]]; then
            echo >&2
            echo "Aborted" >&2
            exit 1
        fi
    done
    echo >&2
    echo "$fulldata2" | kubectl_with_ns apply -f - >&2
}

kubectl_with_ns() {
    if [[ -z "$namespace" ]]; then
        ${KUBECTL:-kubectl} "$@"
    else
        ${KUBECTL:-kubectl} -n "$namespace" "$@"
    fi
}

get_remote() {
    fulldata=$(kubectl_with_ns get secret -o yaml "$secret")
    keytype=$(echo "$fulldata" | sed -e '/^type: /!d;s/^type: //')
    keydata=$(echo "$fulldata" |
              sed -e '/^data:/,/kind: Secret/!d;/^data:/d;/^kind: Secret/d')
    if [[ -z "$keydata" ]] ||
          echo "$keydata" | grep -vE '^  [A-Za-z0-9_.-]+: ' | grep -q ''; then
        echo "Unexpected data:" >&2
        echo "\"$keydata\"" >&2
        exit 1
    fi
    if [[ -n "$key" ]]; then
        keydata=$(echo "$keydata" | grep "^  $key_esc: ")
        if [[ -z "$keydata" ]]; then
            echo "Key $key not found in secret $secret" >&2
            exit 1
        fi
    fi
}

get_local() {
    base64value=$(cat)
    # If single-line, then drop trailing LF. If multi-line, then keep.
    if [[ "$(echo -n "$base64value" | wc -l)" -eq 0 ]]; then
        base64value=$(echo -n "$base64value" | base64 -w0)
    else
        base64value=$(echo "$base64value" | base64 -w0)
    fi
    if [[ -z "$base64value" ]]; then
        echo "No input data; aborting" >&2
        exit 1
    fi
}

if [[ -z "$secret" ]]; then
    list_secrets
elif [[ -z "$write" ]]; then
    if $is_export; then
        export_secret
    else
        list_secret
    fi
else
    edit_secret
fi