bitnami/sealed-secrets

Increase --raw readability

Aperta

#874 aperta il 28 giu 2022

 (5 commenti) (0 reazioni) (0 assegnatari)Go (771 fork)auto 404
help wanted

Metriche repository

Star
 (9222 stelle)
Metriche merge PR
 (Metriche PR in attesa)

Descrizione

Which component: kubeseal v0.17.5

Is your feature request related to a problem? Please describe. The output of --raw when reading from stdin can be confusing in the terminal since the resulting sealed secret is not separated from the input.

Use case explained: to prevent credentials from being stored in .bash_history, I use kubeseal as follows:

me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
secret[CTRL+D][CTRLD+D]

this results in

bash

me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
secretAgChx0O7SeSnISjeaF8G+/.../ajUGQ=me@machine:~$

zsh

me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
secretAgChx0O7SeSnISjeaF8G+/.../ajUGQ=%
me@machine:~$

Now you'll have to be very careful not to accidentally copy the secret before the actual encrypted content and the prompt/percent sign that follows.

Describe the solution you'd like
Either detect tty or add a --human/--formatted/--pretty that adds padding to the commands output.

Suggested output:

me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret
Enter the secret and end with CTRL+D twice:
top-secret-value-here <-- this gets entered by the user followed by double CTRL+D

Secret:
AgBDtACVq1KlnbTXvEiCXtY+eE8QvuoexnWlPOOXlG+B9mPqPNX+H2qYSskvHdJoB0d6LpfbXDMGGy0p/PnrBdLMkp8UmukCe7rjmPdOvgx2v8b4JgtJvxW39rGVvVoqkDF1mm0BocVrM7L27R5Hbmw/8GQzXoeTrd4V+euoQdFPb/yP5hOCuLI1D69tC+7kNF+TwRSQQ2Pl/niYk5X7CueohF5klrMqtmeK3ZSivaU25ais22ggKSVW3OBjcS3lHnkceFcDwMPJruhfFggySOA9bskZpVFB6SOscMpU0ZkEifRHh6v8NOvGqmNrOni86SxNCVWYZTo6+7Qti1Db4O/sQ2G2fQZKM4VdFce+4LrF/Z6OlfnvYlztiOtutmRVtQy5Hi8NEX5g81UDusouYqtU9ZPnVMTOexzHcglXBW6rBvZfJt1Vg3YXTzqe1DFR6vML9vhTZcXsmasT2RXi3H1z7yCB2nLMEETRJkTBwEsX7V74Khq+PBbk514N7+Fxv+KCHHirnSxyHeZsMfBN9WvoUTMXjVVM8k7EW9h7KnSyreCMj/Cl8wUq9bH8ORo+gK+Tg5ayB6eMhqNYcHoBsIbMGB53ESUqBkh00HuTWESuoWecPxONQ6FXM6NDN/I+6zraeGkaBj++4zy1nNaHXskO5MEPYcUEi4VmgxiBAd3fNgjRQYenv2EpLiepx/t3Nno7XKc=
me@machine:~$ kubeseal --raw --from-file=/dev/stdin --name api-secret

Describe alternatives you've considered I have made a small bash script that accomplishes this:

#!/usr/bin/env bash

echo "Enter the secret and end with CTRL+D twice:"
STDIN=$(cat)

echo -e "\n\nSecret:"
echo -n "$STDIN" | kubeseal --raw --from-file=/dev/stdin "$@"
echo ""

It can be used like this ./seal.sh --name api-secrets

Guida contributor