implement secret encryption

.github/workflows/go.yml

@@ -35,7 +35,7 @@ jobs:
           go-version-file: "go.mod"
 
       - name: Test
-        run: go test ./...  -coverprofile=coverage.out
+        run: make test-ci
 
       - name: Send coverage
         uses: shogo82148/actions-goveralls@v1

Makefile

@@ -6,9 +6,16 @@ tidy:
 	go mod tidy
 
 # Run tests
-test: tidy lint
+test: tidy lint test-ci
+test-ci:
 	go test ./...  -coverprofile=coverage.out
-	go tool cover -func=coverage.out
+	@sed -i '/pkg\/mocks/d'              coverage.out
+	@sed -i '/pkg\/export\/archive.go/d' coverage.out
+	@sed -i '/pkg\/export\/export.go/d'  coverage.out
+	@sed -i '/cmd/d'                     coverage.out
+	@sed -i '/uor/d'                     coverage.out
+	@sed -i '/log/d'                     coverage.out
+	go tool cover -func coverage.out
 
 release: semver goreleaser
 	@version=$$($(LOCALBIN)/semver); \

Secret.argocd-secret.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+data:
+  admin.password: AES#Nd1MC5tFFj9msuJ3FKLUQk400YTyn3faLbKanMh8pIgtDlwsmD0GkS9gfsicHdOmxmIgLPjSqJVGEGzK0Oq3IDVKTxAuf4fy4Fm/2/zPk3PAnGux/lfJPwJmbi+m8G2PkjFTSV1CpSn874pC
+  admin.passwordMtime: AES#Nd1MC5tFFj9msuJ3E4zfU0kJpIv1iTfqMY6BrtJ/o8g3DVdlmUs75O1BCwZAlifnBld5jtAQQYw=
+  server.secretkey: AES#Nd1MC5tFFj9msuJ3BKL2Q1cjrZz06m/pGICWgMxA+bcvHl9gjTICkC5mfomAGu2Z9WMwZvv8gqxAdSml1MmzIRlITwoab+2Z6XXSzMca2ORH234lIHzpPQ==
+  tls.crt: AES#Nd1MC5tFFj9msuJ3ErWuXkgjpbDqj2PZKKGSks99hq0qHGIfhkoSjClfKsyBJLGc0l5EVPztuLtuLhfX0ta3WiEUR0gqQJfm7D2dwszJ2wH3skWdzWzOAwdlXzsGkqdWLPCbTwiGkCsGHJoiO6ELAryOPLVRB4kIcZDclxSg2OPlESb/czpxD0dit3dFcWdv8EQ6+Avi39movuE9VSzwORO8gXS8nZIwaDrXLcft6BCDgwAnTbex8JSO3xjmLfiBfEHG6UJIVmI8uJFKrOm+BBY9qW2qoNxTvkbmsXOCnHVsQc69vU2ar4r4hMkwPkIa88rXwWbFAwFNcNj8g1WPvu9U68i7vdpRuRy6dKndGvK7FEN4nrEaxCdcGmchYvqzMCMwo/UV59HoHdt1EL9RLvyuLav7kX8OuV4vtTLEXpxwXcoc+XETx59xDoNRbZtbj2Af1lZqRFDI0/qPwCFUGTRv7YeU3HTYXqUX9EhFvxO5CpaUAqkatNrrIdxS4NM2DAHt8oy4AquLtYWjVqj3h9rLwzYKVPh9LljS5aZzdsEjG+z5wN5ZVpOMwCBOaTPY9hM1Aam9dIx0dwj1RaGt87QRApGpWi8MWrSHA6og2iJYY9Y6bS4C72iu3XAz8OU9pHCgo7GFzIWB8myz/GnPAfWPolmIHTjao+YzplWS4bC/DwX+fGMRMiHsGw78ohGOtJh68L93PApHIkrqLiYL2Dghlhra1qfG98/71oED6JRkS/6hMBTUfB410otbeQsPXL5IPnCYnHe72L4iMV+aH9yM5J+tNDc7V82jlqPxijJx1M1nCy2EDc7ptLDixPsQH3+pULEFkUJjW09OQCFvNS/OqAOkcUmzs3COFcM+bYvrnEg48DoICJ6HetcEiB2RUdAwPtjexLAdysn8a1bjSR+MfPp2oIAaXarJkYcr9PguNVKEMKHeHT3qLfc6648QSpoZwQ56sKidvnDo6/a4JiufEBxQE4Hjdrl069IYjxvN/h4QwC3e1Ol5vqyH6zjmbdR2UfBunaYofZQWQwHWMxs6DnUtWzbROFDC09vIsSIrXnZtWFgrZgHHpdGKRWuA2K6cKkRDSZFYWA6sI2dZhHcLRZ/gopZdwaSGOS6D91eEDBrhYy1oYZrCN1dz2ht6UoZydqL0es2M/+IAETBLsVLGkeSz8XZND0bYIECJ4EbxCvugjLWlGTiN5X9TAgsLqX3agPmxcTkNyOxFho2ig7qcroz0We3bdgQ+VU/lRMvXPMRqZwUDGpBguEfQegUKsy85LVjrYPAs+IvEJhMvMAZ/fVqYnFL3/NCwLcmv7smGPfUvWdMI/tQBT0WXyrtIHG91TfZz/N3eNdxUx86WG3EhZX0F497oSif3spKeI7LcpLXFAm3BcxBLhWhySUoSbmFfbQ2Mkv8Z0XaY3ybv5P8mWgDpKAxkLoibCFBD9sPCFU4tE2zLJUlfWW+sxu5K0j0GcifIEE0YXMAE2lzIyjQbrJbMwW50q2wd01WblLvlTWhsTQUhYqv2LhXji4tfowZ4aTpcBJc6EfoXQfU6cHuuFmx9Wsg9Er9BvZ5i8L7EKgsankHgSl0OEBT9c/e+w1MetyhhHVmaZEGHYWIpNZIY2hBheB0STdc2dlfnBxoPbFlJLxJW3qzmgmXlCEDBzjzP01T1rxGwWts4MLWZ1RZ1SLJJT4btpYJC2tEFa5VP9VeXjr0kOsRHfBh0nbErped0mxl6FlmKHkszG036xsIV/gtZnG9jsme6ij9rJlW9OSw/Btyp1Zl5T3mKLyIuaOteyyOdPogzoRuTdUpAQhxZqLFQw20swZV5+dZDkaFV315gYdeYzBDDIZ0mP6xfAmXog13oT8H4wSwk4gDWdIUX91PVebmRRF5gitNoukUGi53eFDy2zA08vMz7OdLIPFztv0mb/LvGADtTGFOIA2hJyiU9JyALl7fK5UZz79DXlPulQcyNCSnmertCH6iLCXkAWtpBOnNqJNpGKpFHFkXpRx7iofo0mPZb0WoRmaJMWMCpwcnvKxNf09LCbepojfU6ogiyVAN75xjw1AVCMBWK6MWDy8FJpUAYqR0AkYrm53p1l3s4FdW7cPp7jitwVA4BQFLu566cRgxc3qgZKjlyC5uOED2szFSGYuAnqsGQcNMIwtsIDvjzhwUSpVJ/dQ84gra52OYJPEfIL5yJLfH4Ggz0PQqOfZ5lVqqKUD+0vEr1zOaCRO9QBdBkVicV
+  tls.key: AES#Nd1MC5tFFj9msuJ3ErWuXkgjpbDqj2PZKKGShcgbiZ8sD3IfgRESjClfWPSfIeqc3WZFauPpmq9YEDXV4bCFISpPRzkqJZPm41in09at4TPEx2ed/lTGGjVfdRUGgK9EKYaPYySbsk40JaBYJKAfFo6zCqlLJKsocLjinRKjr5XjLgjGQwhYAkBPjXxTSAxr80Q2ihOFw6m21NtCV1vaDRHh5m6LkLQzZAXpAsmKxRGZnQg7fbGTqKWe5Q3nWYDnc13043NjUTkKgYZ5q+rFDRcc+Guro/IpiSHQ013xiwtrNf+eiE24obbrkPwDBxMy5ciO/XufLSBWdqj9hFKQpfdq58+NrN02vnnvX6zdT/C5LUxHrbEC7zsXEmAcQPqhKUYstsUtydDaevocDZBJMvnGPdXvqypWiXwrjwLHfJFvcdYA02EU2p5zeIBhYLl3jAsL7lIcZifL19yt7BhtJjg3y5ClhV3cQ5sTtHwz7TulN7StFs1J9+LrFNZK49MPDHfbtYC2CYOHtqSAZJauptTN0H49ausRL1u5gKZ+ftgiKcGZwoNkWJGh/ix/NSCh8yghapveHIlbAH/hbdWUsKA5L+ybaScLY7SlMqQboSJ1FMUGUkgB5liA53k8l88Dtn2Km764zLSo8Gz91nbxMeybvQSCNBL7pJwnzlbn+r+9Ch3+fHFEEybwOW781RW+gZ92r6h3FSlbC1b0KSYX0gwhljXci6jc9Yfjn64Tm5BWLZb5BX/Mfww3+JF0by0PWtl2J0bCjBaO9r4ZMgGBe/WK5ICiDhURYcyC2abZmh527dV/Og+6DvvA14TZoediEFG9UYYVigtiVUdWVx8cCy+Hlkm7GUmZgASgXO4Gbprwpzsi5hJ/CJWGSMgeix2OaI0dM+qp6e0LyMK4awn0fhO1C/xw+6VvSuK2o4Zf2YYGbm/MNo+iZAehIdElnIMoZu5y1zp+gqe1iGO42trtZimCGC9NI7uoWopZ1/s70h7L1SxK2xPg0Olq3+SMgRrmXNRxK/NWna81fro+RneiKzY5JyorWzKmOkD81tisnyUcAmJzajM/UzqukOKPbGeB39qqKk56HIBYZ3GHBWFzqGxoUZTSgf1GwrarGRaS0XW0D0SdfT0+GK+0Hhlz2jlaV6lic6ORO+KBxuZ7CDB2oWX/lZO2iXo8DCPyH0TUpXH0YtWcvra9JQq55lFnAiUtmU7ziMLHCgkdyPM+rZyUrI7rosjIZeH8YRc2eGPYYtPkP/JpVRR5eKUUoAzQTCs4hxQUK1SBWpAb+I/cJWlAGQVGaSiljEL6ysKWD/yW2NCxLvYob+8HstYgfVGgyLRZGG4sVdpL89LYaOJbxcPTAX94GlkFztrpUSbG66T5BdHewK3lA1HePRMWwFV2WUoJUzgaaD+1lbIa50OIyx3dmusnJWHuKzViL7KtWHhH/YPiSGgFB2XLe31PDBOa/50JyQF6RSPOLRIvctAp1FjUyh5tiqr8+QJNqzNZ2WbukIfmBmgNVHI5Va+fKhTo7pdKo1p8YjxiduoBBogqfpBiNUusPBZ9WeYMFJxj9odY4KvHcjUJtVDoPlxXHB7PXf+yywsZ5R5uYjyUOmCRdjsLD4kk9AphfTdtRe0qGGz4PR07fm94LhJemrjxvE38Gz/h/FbP+mWSgReuSfFGDJWz4BpNYoNLTcbDuLlW2udcXZ1M52mwiL08ItphUShHx49sieR8mB97KESMMSY2NVDcxcNw4gtH+HtagmWlzgZFPhWzBzNXBcOhs59qQwK4EyIDbNB3qwTAJfcBigO1dDxISBp3p7lnqGkowocxw+BshYBj4F5jZ9ebhCSnD48ZOZISAVvgxUegYdzG3jwa7AL8L7Ry1XHPabW1S05wtdN6uksB8ZmGAii6yCEQne33X+uxG3bcl12a+4TwAhUNLVyAKl1z5DwhKAYzvdLK90F21dXJzsK+WMyNFxy8ZpBHNryDJUU2fcUmRUtyI8o7Gq9lOUn7RgHZov13relYxlkTpIJSTsSCweH7VBQ7u6T3UtMMlPYMqzjtTAhkk2/4yz4qPi6Yyrm9rZ0KkAsl5ystv4bZympji2lhFvnSRr9i6RUzXCMzdVG3xZy1eE1n8a8BNDM5HMGIKx+K1VW/Ys4ckPqScP0v89ofXMvPgAkNvgY4dw80/L699s46W2HOMfniJcOPCmrFXHCCZ4giE4reK0i+cAfvF1gvXJQ/CerMk/VR2IroF++p/E+BWIOEqM94OJZrpcGrVhdqDy6881/NsVtPB5TrMdy+ciTTKVIkN9RB8n7lc2VaSjO8nAqjYvW3ma8KoWZ8pRY685EEZtNoVRGAoaZgkYZ/q4HwfhWUu2r8V1/peeUhpaE/bqQz8yw1nu4qbS97h2DflwRYumkZ2Nxfi6uwbsYw+1TZ1NpQPUcxlW42ZN6me7STeY+623oKbPwPpPUwhDq12MQSA4GaIbtqOCW7wfJWJSzGzuWC7DogRB57TvU7xbsXCmGOJ36bwM7KPaKC6SQ2ZGLZWMOBW+qc70PLJbL6foUvKgNtrUtzgALcRJ/+56RtYSeEhOHd6jQ4tOHCFxN6VTQXMGVr32vjfPu/IsLnYbX9miZhYW30f+fAX3+Y+jYZFCtyfZPdO/kPHUxRW5A2zZ4yVT+zehF7lFyK1aqxDWqzBFY6OTpTm9cSFnRdloXCJsObHRhkRpHsOaNJm3ug+7HXOPOrUoqpQRyilKVAjQnftuBGstLiJwuJLRMyJRe7kxUBYzKYdU8cLvVv8lnxDnaY1WPMBLsFukLUBQTTTZxLYrVrCYof0UiOPXF43TLBDCORgg+keRoo1cYOHxIblCxnCG5jj60gI/Sdj5nrcA32wq8naWaFWVdoKEflbli/Z/4qTfvrPWbiHwcUCnCmY8uAx1LjUVSC4nagNdYfpiijm00q0paUhKWBhaPTtXPlJCu6NwfE8XTTZKb+qZe3BJdseQuf81o6nzo3eeRf9SUxGwF6TUAzZU0wzQ/rp2w=
+kind: Secret
+metadata:
+  annotations:
+    meta.helm.sh/release-name: argocd
+    meta.helm.sh/release-namespace: argocd
+  labels:
+    app.kubernetes.io/component: server
+    app.kubernetes.io/instance: argocd
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: argocd-secret
+    app.kubernetes.io/part-of: argocd
+    app.kubernetes.io/version: v2.9.5
+    argocd.argoproj.io/instance: argocd
+    helm.sh/chart: argo-cd-5.53.10
+  name: argocd-secret
+  namespace: argocd
+type: Opaque

cmd/decrypt.go

@@ -0,0 +1,44 @@
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/bakito/kubexporter/pkg/types"
+	"github.com/spf13/cobra"
+	"golang.org/x/term"
+)
+
+// decrypt
+var (
+	resourceFiles []string
+	aesKey        string
+
+	decrypt = &cobra.Command{
+		Use:     "decrypt",
+		Aliases: []string{"uor"},
+		Short:   "Decrypt secrets in exported resource files",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if k, ok := os.LookupEnv(types.EnvAesKey); ok {
+				aesKey = k
+			}
+
+			if aesKey == "" {
+				fmt.Println("Please the aes key: ")
+				key, err := term.ReadPassword(int(os.Stdin.Fd()))
+				if err != nil {
+					return err
+				}
+				aesKey = string(key)
+			}
+
+			return types.Decrypt(printFlags, aesKey, resourceFiles...)
+		},
+	}
+)
+
+func init() {
+	rootCmd.AddCommand(decrypt)
+	decrypt.PersistentFlags().StringArrayVar(&resourceFiles, "file", nil, "resource files to decrypt")
+	decrypt.PersistentFlags().StringVar(&aesKey, "aes-key", "", "the decryption key")
+}

cmd/root.go

@@ -93,6 +93,12 @@ func readConfig(cmd *cobra.Command, configFlags *genericclioptions.ConfigFlags,
 		return nil, err
 	}
 
+	if err := config.Encrypted.Setup(); err != nil {
+		return nil, err
+	}
+
+	config.Encrypted.KindFields = config.Masked.KindFields.Diff(config.Encrypted.KindFields)
+
 	return config, nil
 }
 
@@ -132,4 +138,6 @@ func init() {
 	klog.InitFlags(fs)
 	_ = fs.Parse([]string{"-logtostderr=false"})
 	klog.SetOutput(io.Discard)
+
+	printFlags.AddFlags(decrypt)
 }

config.yaml

@@ -8,12 +8,18 @@ asLists: false
 #queryPageSize: 1000
 clearTarget: true
 worker: 5
+encrypted:
+  aesKey: "12345678901234567890123456789012"
+  kindFields:
+    Secret:
+      - [ data ]
+      - [ stringData ]
 masked:
   replacement: '***'
   checksum: md5
   kindFields:
     Secret:
-      - [ data ]
+      - [ stringData ]
 considerOwnerReferences: true
 excluded:
   kinds:

go.mod

@@ -17,6 +17,7 @@ require (
 	github.com/vardius/worker-pool/v2 v2.1.0
 	github.com/vbauerster/mpb/v5 v5.4.0
 	go.uber.org/mock v0.4.0
+	golang.org/x/term v0.17.0
 	k8s.io/api v0.29.2
 	k8s.io/apimachinery v0.29.2
 	k8s.io/cli-runtime v0.29.2
@@ -410,7 +411,6 @@ require (
 	golang.org/x/oauth2 v0.16.0 // indirect
 	golang.org/x/sync v0.6.0 // indirect
 	golang.org/x/sys v0.17.0 // indirect
-	golang.org/x/term v0.17.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	golang.org/x/tools v0.18.0 // indirect

pkg/export/export.go

@@ -144,6 +144,13 @@ func (e *exporter) writeIntro() {
 		e.l.Printf("  considering owner references 👑\n")
 	}
 
+	if len(e.config.Masked.KindFields) > 0 {
+		e.l.Printf("  masked fields 🤿 %v\n", e.config.Masked.KindFields)
+	}
+	if len(e.config.Encrypted.KindFields) > 0 {
+		e.l.Printf("  encrypted fields 🔒 %v\n", e.config.Encrypted.KindFields)
+	}
+
 	if e.config.AsLists {
 		e.l.Printf("  as lists 📦\n")
 	} else if e.config.QueryPageSize != 0 {

pkg/export/worker/worker.go

@@ -13,6 +13,7 @@ import (
 	"github.com/bakito/kubexporter/pkg/client"
 	"github.com/bakito/kubexporter/pkg/log"
 	"github.com/bakito/kubexporter/pkg/types"
+	"github.com/bakito/kubexporter/pkg/utils"
 	"github.com/vbauerster/mpb/v5"
 	"github.com/vbauerster/mpb/v5/decor"
 	"k8s.io/apimachinery/pkg/api/errors"
@@ -250,6 +251,7 @@ func (w *worker) exportLists(res *types.GroupResource, ul *unstructured.Unstruct
 		if !w.config.IsInstanceExcluded(res, u) {
 			w.config.FilterFields(res, u)
 			w.config.MaskFields(res, u)
+			w.config.EncryptFields(res, u)
 			w.config.SortSliceFields(res, u)
 
 			if _, ok := perNs[u.GetNamespace()]; !ok {
@@ -279,7 +281,7 @@ func (w *worker) exportLists(res *types.GroupResource, ul *unstructured.Unstruct
 			continue
 		}
 
-		err = w.config.PrintObj(usl, f)
+		err = utils.PrintObj(w.config.PrintFlags, usl, f)
 		if err != nil {
 			res.Error = err.Error()
 			continue
@@ -306,6 +308,7 @@ func (w *worker) exportSingleResources(res *types.GroupResource, ul *unstructure
 			w.stats.addNamespace(u.GetNamespace())
 			w.config.FilterFields(res, u)
 			w.config.MaskFields(res, u)
+			w.config.EncryptFields(res, u)
 			w.config.SortSliceFields(res, u)
 			us := &u
 
@@ -329,7 +332,7 @@ func (w *worker) exportSingleResources(res *types.GroupResource, ul *unstructure
 				continue
 			}
 
-			err = w.config.PrintObj(us, f)
+			err = utils.PrintObj(w.config.PrintFlags, us, f)
 			if err != nil {
 				res.Error = err.Error()
 				continue