Repository metrics
- Stars
- (9,222 stars)
- PR merge metrics
- (PR metrics pending)
Description
Which component: kubeseal v0.17.5
Is your feature request related to a problem? Please describe.
The output of --raw when reading from stdin can be confusing in the terminal since the resulting sealed secret is not separated from the input.
Use case explained: to prevent credentials from being stored in .bash_history, I use kubeseal as follows:
me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
secret[CTRL+D][CTRLD+D]
this results in
bash
me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
secretAgChx0O7SeSnISjeaF8G+/.../ajUGQ=me@machine:~$
zsh
me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
secretAgChx0O7SeSnISjeaF8G+/.../ajUGQ=%
me@machine:~$
Now you'll have to be very careful not to accidentally copy the secret before the actual encrypted content and the prompt/percent sign that follows.
Describe the solution you'd like
Either detect tty or add a --human/--formatted/--pretty that adds padding to the commands output.
Suggested output:
me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
Enter the secret and end with CTRL+D twice:
top-secret-value-here <-- this gets entered by the user followed by double CTRL+D
Secret:
AgBDtACVq1KlnbTXvEiCXtY+eE8QvuoexnWlPOOXlG+B9mPqPNX+H2qYSskvHdJoB0d6LpfbXDMGGy0p/PnrBdLMkp8UmukCe7rjmPdOvgx2v8b4JgtJvxW39rGVvVoqkDF1mm0BocVrM7L27R5Hbmw/8GQzXoeTrd4V+euoQdFPb/yP5hOCuLI1D69tC+7kNF+TwRSQQ2Pl/niYk5X7CueohF5klrMqtmeK3ZSivaU25ais22ggKSVW3OBjcS3lHnkceFcDwMPJruhfFggySOA9bskZpVFB6SOscMpU0ZkEifRHh6v8NOvGqmNrOni86SxNCVWYZTo6+7Qti1Db4O/sQ2G2fQZKM4VdFce+4LrF/Z6OlfnvYlztiOtutmRVtQy5Hi8NEX5g81UDusouYqtU9ZPnVMTOexzHcglXBW6rBvZfJt1Vg3YXTzqe1DFR6vML9vhTZcXsmasT2RXi3H1z7yCB2nLMEETRJkTBwEsX7V74Khq+PBbk514N7+Fxv+KCHHirnSxyHeZsMfBN9WvoUTMXjVVM8k7EW9h7KnSyreCMj/Cl8wUq9bH8ORo+gK+Tg5ayB6eMhqNYcHoBsIbMGB53ESUqBkh00HuTWESuoWecPxONQ6FXM6NDN/I+6zraeGkaBj++4zy1nNaHXskO5MEPYcUEi4VmgxiBAd3fNgjRQYenv2EpLiepx/t3Nno7XKc=
me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
Describe alternatives you've considered I have made a small bash script that accomplishes this:
#!/usr/bin/env bash
echo "Enter the secret and end with CTRL+D twice:"
STDIN=$(cat)
echo -e "\n\nSecret:"
echo -n "$STDIN" | kubeseal --raw --from-file=/dev/stdin "$@"
echo ""
It can be used like this ./seal.sh --name api-secrets