Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unseal with --raw #1485

Closed
vavsab opened this issue Mar 14, 2024 · 6 comments
Closed

Unseal with --raw #1485

vavsab opened this issue Mar 14, 2024 · 6 comments

Comments

@vavsab
Copy link
Contributor

vavsab commented Mar 14, 2024

Which component:
kubeseal

Is your feature request related to a problem? Please describe.
I really enjoy raw mode for encrypting a single value
echo -n "MY_SECRET_VALUE" | ./kubeseal --cert ./MY_CERT.crt --namespace MY_NAMESPACE --scope namespace-wide --raw
It would be really nice to have exactly same unseal functionality
echo -n "ENCRYPTED_VALUE" | ./kubeseal --recovery-unseal --recovery-private-key ./MY_KEY.key --namespace MY_NAMESPACE --scope namespace-wide --raw

Describe the solution you'd like
I can make a PR if you are ok with this idea.

Describe alternatives you've considered
I can provide the whole SealedSecret but usually I'm interested only in a single value.

Additional context

@vavsab vavsab added the triage Issues/PRs that need to be reviewed label Mar 14, 2024
@agarcia-oss agarcia-oss added enhancement good first issue and removed triage Issues/PRs that need to be reviewed labels Mar 21, 2024
@agarcia-oss
Copy link
Member

Hi @vavsab looks like a good improvement and we'll be happy to review a PR if you'd like to send it!

@vavsab
Copy link
Contributor Author

vavsab commented Mar 21, 2024

@agarcia-oss Was there a reason to use stdin for --raw mode instead of passing it as a param? Passing as a param simplifies the usage so much.
I'm making a script for my company to encrypt a value easily by using the official kubeseal docker image. And it becomes so complicated when need to deal with docker + stdin + gitbash on windows 😬. I managed to make it work but just curious why kubeseal is using stdin.

@mkmik
Copy link
Collaborator

mkmik commented Mar 21, 2024

the original reason for passing secrets in stdin instead of passing them as literal in params is that the latter causes secrets to be visible in /proc and saved in shell histories.

I know there are cases when somebody doesn't care about that so it's perfectly fine to add an option to pass a secret literal on the cmdline, I just didn't want to have that to be the first and most illustrated way of doing it

Copy link

github-actions bot commented Apr 6, 2024

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

Copy link

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

@github-actions github-actions bot added the Stale label Apr 27, 2024
Copy link

github-actions bot commented May 4, 2024

Due to the lack of activity in the last 7 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.

@github-actions github-actions bot closed this as not planned Won't fix, can't repro, duplicate, stale May 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants