bitnami/sealed-secrets

Increase --raw readability

Offen

#874 geöffnet am 28.06.2022

 (5 Kommentare) (0 Reaktionen) (0 zugewiesene Personen)Go (771 Forks)auto 404
help wanted

Repository-Metriken

Stars
 (9.222 Sterne)
PR-Merge-Metriken
 (PR-Metriken ausstehend)

Beschreibung

Which component: kubeseal v0.17.5

Is your feature request related to a problem? Please describe. The output of --raw when reading from stdin can be confusing in the terminal since the resulting sealed secret is not separated from the input.

Use case explained: to prevent credentials from being stored in .bash_history, I use kubeseal as follows:

me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
secret[CTRL+D][CTRLD+D]

this results in

bash

me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
secretAgChx0O7SeSnISjeaF8G+/.../ajUGQ=me@machine:~$

zsh

me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
secretAgChx0O7SeSnISjeaF8G+/.../ajUGQ=%
me@machine:~$

Now you'll have to be very careful not to accidentally copy the secret before the actual encrypted content and the prompt/percent sign that follows.

Describe the solution you'd like
Either detect tty or add a --human/--formatted/--pretty that adds padding to the commands output.

Suggested output:

me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
Enter the secret and end with CTRL+D twice:
top-secret-value-here <-- this gets entered by the user followed by double CTRL+D

Secret:
AgBDtACVq1KlnbTXvEiCXtY+eE8QvuoexnWlPOOXlG+B9mPqPNX+H2qYSskvHdJoB0d6LpfbXDMGGy0p/PnrBdLMkp8UmukCe7rjmPdOvgx2v8b4JgtJvxW39rGVvVoqkDF1mm0BocVrM7L27R5Hbmw/8GQzXoeTrd4V+euoQdFPb/yP5hOCuLI1D69tC+7kNF+TwRSQQ2Pl/niYk5X7CueohF5klrMqtmeK3ZSivaU25ais22ggKSVW3OBjcS3lHnkceFcDwMPJruhfFggySOA9bskZpVFB6SOscMpU0ZkEifRHh6v8NOvGqmNrOni86SxNCVWYZTo6+7Qti1Db4O/sQ2G2fQZKM4VdFce+4LrF/Z6OlfnvYlztiOtutmRVtQy5Hi8NEX5g81UDusouYqtU9ZPnVMTOexzHcglXBW6rBvZfJt1Vg3YXTzqe1DFR6vML9vhTZcXsmasT2RXi3H1z7yCB2nLMEETRJkTBwEsX7V74Khq+PBbk514N7+Fxv+KCHHirnSxyHeZsMfBN9WvoUTMXjVVM8k7EW9h7KnSyreCMj/Cl8wUq9bH8ORo+gK+Tg5ayB6eMhqNYcHoBsIbMGB53ESUqBkh00HuTWESuoWecPxONQ6FXM6NDN/I+6zraeGkaBj++4zy1nNaHXskO5MEPYcUEi4VmgxiBAd3fNgjRQYenv2EpLiepx/t3Nno7XKc=
me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret

Describe alternatives you've considered I have made a small bash script that accomplishes this:

#!/usr/bin/env bash

echo "Enter the secret and end with CTRL+D twice:"
STDIN=$(cat)

echo -e "\n\nSecret:"
echo -n "$STDIN" | kubeseal --raw --from-file=/dev/stdin "$@"
echo ""

It can be used like this ./seal.sh --name api-secrets

Contributor Guide