rajatjindal / kubectl-modify-secret

kubectl-modify-secrets allows user to directly modify the secret without worrying about base64 encoding/decoding

kubectl-modify-secret

kubectl-modify-secret is a kubectl plugin that allows user to modify the secret without having to worry about doing base64 encoding/decoding.

This plugin pulls the secret from Kubernetes, and open the configured editor with just the decoded secret data. Once user makes changes, save and quit the editor, the plugin automatically apply the updated data to Kubernetes.

Installing via krew

• install krew using instructions here
• run kubectl krew update
• run kubectl krew install modify-secret

Install via brew

• run brew install rajatjindal/tap/modify-secret

Usage

• use namespace and kubeconfig from $KUBECONFIG current context

    kubectl modify-secret xyz

• provide namespace explicitly

    kubectl modify-secret xyz -n kube-system

• use different kubeconfig file

    kubectl modify-secret xyz --kubeconfig /path/to/different/kube/config

kubectl-modify-secret's Issues

Error: no Auth Provider found for name "gcp"

It has an error when using a GKE (Google Kubernetes Engine) Cluster

Error: no Auth Provider found for name "gcp"

Does not work for GKE 1.25+

W0329 09:19:29.168946  269330 gcp.go:120] WARNING: the gcp auth plugin is deprecated in v1.22+, unavailable in v1.25+; use gcloud instead.
To learn more, consult https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke
Error: only one argument is allowed

Add YAML syntax highlight in the editor

Hi! Thanks for the plugin, @rajatjindal, it does the job really well! 😊 👍

But it would be even better if the decoded file would be open with a syntax highlight in the editor.

In the case of my vim, but probably other editors will work the same, it should be enough to add .yaml extension to the temporary file.

support editing multiple secrets

support editing multiple secrets

windows

Hi,

I noticed I got: failed to install plugin "modify-secret": plugin "modify-secret" does not offer installation for this platform when trying to install via krew. Also noticed that the windows line was commented out in build.sh. Is it possible to get this for Windows?

Thanks

Trailing whitespice in base64 encoded string

To me it seems like secrets are generated with trailing whitespace, similar to echo vs echo -n. I would expect secrets without trailing linefeed, or is it intentional? Or some misconfiguration on our part?

identify if no changes were done and print msg accordingly

right now, even if you don't make any changes, the plugin prints msg:

INFO[0006] secret "secret-name" edited

if there were no changes, we should identify that, and print

INFO[0006] no changes done to secret "secret-name"

[krew] Distribute with license

👋 Hello, maintainer of the kubectl plugin manager krew here.

Thank you for your commitment to open source by making this plugin available via krew!

Krew wants to give credit where credit is due by installing the proper license file for the plugins it distributes. However, your plugin was found to not contain any license file. We wanted to remind you that if you're using a license such as Apache 2.0, you should be bundling your LICENSE file with your plugin’s distributions.

What do you have to do?

• Please ensure your GitHub repository has a license file.
• Make sure your archive file (.tar.gz or .zip) contains the license file.
• Please submit a pull-request to krew-index and update the files: section to copy the file to the installation directory. Have a look at this PR for an example: https://github.com/kubernetes-sigs/krew-index/pull/314/files

If you need further assistance, don't hesitate to ask for help.

audit, sign, trust

Why not signed

brew install rajatjindal/tap/modify-secret
'brew' is not recognized as an internal or external command,
operable program or batch file.

kubectl krew install modify-secret
Updated the local copy of plugin index.
Installing plugin: modify-secret
Installed plugin: modify-secret

| Use this plugin:
| kubectl modify-secret
| Documentation:
| https://github.com/rajatjindal/kubectl-modify-secret
/
WARNING: You installed plugin "modify-secret" from the krew-index plugin repository.
These plugins are not audited for security by the Krew maintainers.
Run them at your own risk.

Installation is not working on a mac M1 (darwin/arm64).

Hello @rajatjindal !

Following your latest update v0.0.41, the target darwin/arm64 can't be installed (mac m1).

I find out, two issues :
1 - https://github.com/kubernetes-sigs/krew-index (the default repository) is not yet updated for v0.0.41.
2 - using a custom install source with updated krew.yaml. I finally find that this file doesn't exist :
https://github.com/rajatjindal/kubectl-modify-secret/releases/download/v0.0.41/kubectl-modify-secret_v0.0.41_darwin_arm64.tar.gz

I try to install https://github.com/rajatjindal/kubectl-modify-secret/releases/download/v0.0.41/kubectl-modify-secret_v0.0.41_linux_arm64.tar.gz in an ARM64 ubuntu (vm still on my M1), but it doesn't work too.

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.2", GitCommit:"8b5a19147530eaac9476b0ab82980b4088bbc1b2", GitTreeState:"clean", BuildDate:"2021-09-15T21:31:32Z", GoVersion:"go1.16.9", Compiler:"gc", Platform:"darwin/arm64"}
Server Version: version.Info{Major:"1", Minor:"19+", GitVersion:"v1.19.14-gke.1900", GitCommit:"abc4e63ae76afef74b341d2dba1892471781604f", GitTreeState:"clean", BuildDate:"2021-09-07T09:21:04Z", GoVersion:"go1.15.15b5", Compiler:"gc", Platform:"linux/amd64"}
WARNING: version difference between client (1.22) and server (1.19) exceeds the supported minor version skew of +/-1


$kubectl krew version
GitTag            v0.4.2
GitCommit         6fcdb79
IndexURI          https://github.com/kubernetes-sigs/krew-index.git
BasePath          /Users/xxx/.krew
IndexPath         /Users/xxx/.krew/index/default
InstallPath       /Users/xxx/.krew/store
BinPath           /Users/xxx/.krew/bin
DetectedPlatform  darwin/arm64

Improved editing of empty secrets

If you create an empty secret and then use modify-secret to add data to it, you get presented with an empty JSON document, which is confusing if you were expecting to write YAML:

$ kubectl create secret generic dcarley
secret/dcarley created
$ EDITOR=cat kubectl modify-secret dcarley
{}
INFO[0000] no changes done to secret "dcarley"

This seems to be a "feature" of the YAML library when you marshal an empty map:

• https://play.golang.org/p/9Byzr0yfQD3

What do you think about detecting this and presenting a completely empty document instead?

error: unknown command "modify-secret" for "kubectl"

I want to install kubectl-modify-secret to my Ubuntu 20.04.3 LTS @rajatjindal

I downloaded the archive file from releases, https://github.com/rajatjindal/kubectl-modify-secret/releases/download/v0.0.43/kubectl-modify-secret_v0.0.43_linux_amd64.tar.gz

Extracted tile file and move /usr/local/bin

and I have the following error when I confirm the installation

kubectl modify-secret --help

error: unknown command "modify-secret" for "kubectl"

--print option to print the secret without opening it in a text editor

Hi @rajatjindal , thanks for this plugin 🙂

Sometimes, I just want to print the secret without editing it, an option like --print will be great to just print the secret without open an editor.

Install via brew fails: Install Clang or run `brew install gcc`.

I get this error on Ubuntu-22.04

❯ brew install rajatjindal/tap/modify-secret
==> Auto-updating Homebrew...
Adjust how often this is run with HOMEBREW_AUTO_UPDATE_SECS or disable with
HOMEBREW_NO_AUTO_UPDATE. Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).
==> Auto-updated Homebrew!
Updated 3 taps (homebrew/bundle, homebrew/core and homebrew/cask).
==> New Formulae
ansible-creator                       forbidden                             kconf                                 nextdns
==> New Casks
msty                                                                        yass

You have 1 outdated formula installed.

==> Tapping rajatjindal/tap
Cloning into '/home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/rajatjindal/homebrew-tap'...
remote: Enumerating objects: 32, done.
remote: Counting objects: 100% (32/32), done.
remote: Compressing objects: 100% (11/11), done.
Receiving objects: 100% (32/32), 9.41 KiB | 4.71 MiB/s, done.
Resolving deltas: 100% (6/6), done.
remote: Total 32 (delta 6), reused 32 (delta 6), pack-reused 0
Tapped 1 formula (12 files, 78KB).
==> Fetching rajatjindal/tap/modify-secret
==> Downloading https://github.com/rajatjindal/kubectl-modify-secret/releases/download/v0.0.46/kubectl-modify-secret_v0.0.46_linux_amd64.tar.gz
==> Downloading from https://objects.githubusercontent.com/github-production-release-asset-2e65be/210006932/09943c74-b081-4051-b497-a0af2bf0eaed?X-Amz-
################################################################################################################################################ 100.0%
==> Installing modify-secret from rajatjindal/tap
Error: The following formula cannot be installed from bottle and must be
built from source.
  modify-secret
Install Clang or run `brew install gcc`.

Why is gcc needed?

Wrong formatting after editing

I've faced with the issue then I edited the secret, saved it, and closed it. Reopened it using modify-secret and I saw not a properly formatted file as the previous option but a string with a value, like that
application.properties: "all_secrets_here_in_one_row_splitted_by_\n"

All my rows were in value in one line and \n was shown between old rows. Everything was fine if I opened it with edit secret and decoded it.
I've rechecked it and I didn't see any unusual chars, encoded it and resaved using edit secret and tried to open it with modify-secret but the issue was the same.

Sorry, but I can't show this secret, but I've tried to describe it as best I can.
This issue occurred sporadically on various unrelated namespaces. I don't have the steps to reproduce I changed various things

UPD. For now, this happens only in case I paste a big piece of properties. Maybe some kind of char there but I don't see any strange of them.

Fails if $EDITOR has command line arguments

My EDITOR environment variable is set to "code --wait"

When I run kubectl modify-secret I get the following output:

Error: exec: "code --wait": executable file not found in $PATH

kubectl edit works as expected.

BTW, awesome plugin!

Use "KUBE_EDITOR" instead of "EDITOR"

kubectl supports using the KUBE_EDITOR env var for setting the editor to use for kubectl commands, as a kubectl plugin it feels appropriate to have kubectl-modify-secret check that env variable first, then check EDITOR, and lastly default to vi (as it does right now).

I'd be ok putting up a PR for this if the proposal sounds reasonable.

Feature request: installable via homebrew.

I use homebrew for almost all software. It is supported by all major platforms: Linux, Mac and WSL.

It would be great if I could install modify-secret via homebrew.

Thank you for this tool, it is really handy.

darwin/arm64 support

It seems that the plugin does not have darwin/arm64 support, this is super useful for me as a plugin so I will push up a PR shortly.