Merge pull request #1 from k8s-at-home/fix-and-feat

Add tests directory try wiring in CI

.gitignore

@@ -0,0 +1,2 @@
+# Sops
+.decrypted~*.yaml

.pre-commit-config.yaml

@@ -8,10 +8,6 @@ repos:
       - id: check-merge-conflict
       - id: detect-private-key
       - id: trailing-whitespace
-  - repo: https://github.com/Lucas-C/pre-commit-hooks-markup
-    rev: v1.0.1
-    hooks:
-      - id: rst-linter
   - repo: https://github.com/adrienverge/yamllint
     rev: v1.25.0
     hooks:

.pre-commit-hooks.yaml

@@ -3,5 +3,5 @@
   name: Verify sops files
   description: Verify that sops files are encrypted.
   language: script
-  files: ((^|/)*.y[a]{0,1}ml$)
+  files: ((^|/)*.(ya?ml)$)
   entry: find-unencrypted-secrets.sh

README.md

@@ -1,5 +1,7 @@
 # sops-pre-commit
 
+[![pre-commit.ci status](https://results.pre-commit.ci/badge/github/k8s-at-home/sops-pre-commit/main.svg)](https://results.pre-commit.ci/latest/github/k8s-at-home/sops-pre-commit/main)
+
 Sops [pre-commit](https://pre-commit.com/) hook.
 
 * Check for unencrypted Kubernetes secrets in manifest files.

find-unencrypted-secrets.sh

@@ -1,9 +1,26 @@
-#!/bin/sh
-## angelnu k8s@home
-FILE_WITH_SECRETS=$(grep -lZRPi '^kind:\s+secret' . | xargs -r0 grep -L 'ENC.AES256')
-if [ -z "$FILE_WITH_SECRETS" ]; then
-  exit 0
-else
-  echo "$FILE_WITH_SECRETS has unencrypted secrets! (or at least not encrypted with AES256)"
-  exit 1
-fi
+#!/usr/bin/env bash
+set -eu
+
+# OSX GUI apps do not pick up environment variables the same way as Terminal apps and there are no easy solutions,
+# especially as Apple changes the GUI app behavior every release (see https://stackoverflow.com/q/135688/483528). As a
+# workaround to allow GitHub Desktop to work, add this (hopefully harmless) setting here.
+export PATH=$PATH:/usr/local/bin
+
+secret_regex="^kind:\s+secret"
+sops_regex="ENC.AES256"
+
+has_error=0
+for file in "$@"; do
+    if (grep -q -i -P "${secret_regex}" "${file}"); then
+        if ! (grep -q -P "${sops_regex}" "${file}"); then
+            echo "ERROR: ${file} is not encrypted"
+            has_error=1
+        fi
+    fi
+done
+
+if [[ "${has_error}" -eq 1 ]] ; then
+    echo "To ignore, use --no-verify"
+fi
+
+exit $has_error

tests/secret-fail.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+data:
+  password: Y2hhbmdlLW1l
+  user: YWRtaW4=
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: basic-auth

tests/secret-fail.yml

@@ -0,0 +1,8 @@
+apiVersion: v1
+data:
+  password: Y2hhbmdlLW1l
+  user: YWRtaW4=
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: basic-auth

tests/secret-ignore.txt

@@ -0,0 +1,8 @@
+apiVersion: v1
+data:
+  password: Y2hhbmdlLW1l
+  user: YWRtaW4=
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: basic-auth

tests/secret-ignore.yaml.j2

@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ca-key-pair
+  namespace: {{ cert_manager_namespace }}
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURvRENDQW9pZ0F3SUJBZ0lVYXRUWVNIK1lUMVJvbXVGekF2clFRWGtsQ0Vrd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2FERUxNQWtHQTFVRUJoTUNWVk14RHpBTkJnTlZCQWdUQms5eVpXZHZiakVSTUE4R0ExVUVCeE1JVUc5eQpkR3hoYm1ReEV6QVJCZ05WQkFvVENrdDFZbVZ5Ym1WMFpYTXhDekFKQmdOVkJBc1RBa05CTVJNd0VRWURWUVFECkV3cExkV0psY201bGRHVnpNQjRYRFRJd01EY3hNREUxTWpFd01Gb1hEVEkxTURjd09URTFNakV3TUZvd2FERUwKTUFrR0ExVUVCaE1DVlZNeER6QU5CZ05WQkFnVEJrOXlaV2R2YmpFUk1BOEdBMVVFQnhNSVVHOXlkR3hoYm1ReApFekFSQmdOVkJBb1RDa3QxWW1WeWJtVjBaWE14Q3pBSkJnTlZCQXNUQWtOQk1STXdFUVlEVlFRREV3cExkV0psCmNtNWxkR1Z6TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF0MmZFNUhRSm8vNGIKRjNqN1JPZzJ6REhNdEhLd0pjVEZZYkZZMGpIWGZTVWJTS1ZObzUrNTNqQ29SdFFWd1FyYU12QnozMGRJbzd6agpMcE1VQU5aRStacXQrbkk5RWtzMVphS1NKNmYvNXpmZDEzZ1ZOTkgzN05KVUVKV0NHTnVoUmVFNDRpcUtmSDV3Ck9iZlJKL2ZCYVQ5cW9DQW9tWVcvV1JUS0t5ancreFBPeWdZZERsUk9jdzBSRmdieDkvWk5GS1lYR3BQcmdyR0wKWW45VWZXZG92WHozbys3N1piNm9SRWdBVkNDUTBaN0VEYUpjd3RCZkxOV0pWbGRET2dJNFpmWDBaNnNBN2lobgptQ1hHenJGd25JaVhaajUrdjk0ejF0SThOazlvL1RFbG9EdlJnamJNblRxQ2hGa1ZROHhtaXMwckZmMVprN3ZwCjNOMWFtY2hBQVFJREFRQUJvMEl3UURBT0JnTlZIUThCQWY4RUJBTUNBUVl3RHdZRFZSMFRBUUgvQkFVd0F3RUIKL3pBZEJnTlZIUTRFRmdRVTFEaTE0aVpKWGczajNObHdjenZFR1dwRFN2SXdEUVlKS29aSWh2Y05BUUVMQlFBRApnZ0VCQURkR1FDSFcwNkFVZUo4alM3cURPM2F1TG4xTHE0c1JCWHBoVUZ6TGRyMi9rUUlZd1BtcTRmb09RMjBwCitLTVUyanpmR0VHd3ZOU0p2QnphNHRGS1NiZHRpeFI3RmsyREdPLzc5a3ZPZ2o3UVRrUUpkUzNwaWtSc09EMlUKaytpa09qL2wyTkRSRFVXZlh4RjRjeVZTZ0VubDExUUVDa0JrUHBIYlIrUHQxYWhnMGVRMElnL0MvZC8vN2Vtegp3ZWNUZjBsQkc1UmszaURHdkxhaHdTek9jQWhSY1BxVW9idCs1bTVycmp0R3BrTFNQOTBzVko2TTZ3ZE43dGR4CkNpTktWWGRZaHBZWmUrQ1hEQ2lRR0NLVHE5NHJPbGptVmh5Z0FKWjlBOERVOWVZRmVOci9oOW84c2JYNFlzcU0KV3YwREkyQldlQ3k3MmlXZXErNHkwTENKSzQ4PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBdDJmRTVIUUpvLzRiRjNqN1JPZzJ6REhNdEhLd0pjVEZZYkZZMGpIWGZTVWJTS1ZOCm81KzUzakNvUnRRVndRcmFNdkJ6MzBkSW83empMcE1VQU5aRStacXQrbkk5RWtzMVphS1NKNmYvNXpmZDEzZ1YKTk5IMzdOSlVFSldDR051aFJlRTQ0aXFLZkg1d09iZlJKL2ZCYVQ5cW9DQW9tWVcvV1JUS0t5ancreFBPeWdZZApEbFJPY3cwUkZnYng5L1pORktZWEdwUHJnckdMWW45VWZXZG92WHozbys3N1piNm9SRWdBVkNDUTBaN0VEYUpjCnd0QmZMTldKVmxkRE9nSTRaZlgwWjZzQTdpaG5tQ1hHenJGd25JaVhaajUrdjk0ejF0SThOazlvL1RFbG9EdlIKZ2piTW5UcUNoRmtWUTh4bWlzMHJGZjFaazd2cDNOMWFtY2hBQVFJREFRQUJBb0lCQUJZd2R0RFEvUzJiRzduKwpTQ0F4SEJnZVdrN21wVXNjZ0dqdVpQbWhVQm55K0ZjVXNNMEFFU1BCclVwTWRJbFRmOHl6N01EeHhlY1Jma2J2ClFuZExkVExodFBUZEIyaUVNdVNtQTVyS3A1cFkxdjB2cVJrbjRpQUQzbW5YUE5NM0YwNzJEY1RITXRRWEZBclgKbzNWN2N5b0JveXZXV0RNaXpHREJ0Q2YrbnhFeFFzS0lLUGFxRzlDVWZlSU95RVgzRXJ6QWo3b3lnSXFLZGozbgpFbVBzbThrWDVROW9iOUZwd3FKNkxMTzcxTklQZnpaOUNLSXpSYzBNU3grL3hPYmdKSlJCNmtZTXpjWkloQ1JBClNNclBsYXZLMEVzMHpoTnIyc05aZHBlSmRzWGk5YURwZjhMOTEvdFpJeEpSMEdSUXpEZXhBN2FWdk8vVUo0N0YKOXNXUVBUVUNnWUVBeXNvTm01VHdkNWZqRzk3NXVRa3pGQUgrRGVCNXBlNTBOMkpyN01neWZsVm8zZlJrSTFKKwpsZXlyUnRIempKSzlqeEVtdVJ0YnIvUWZ3MGRUNnhRSnVJSmk3Vmlld3NPNUgzeWtwdytkbm9jVUhVVDhFWEpVCnpLSzRmSGo1SjFrNHBmaHlnNFBJZ0YxMFF1anhJRlc3Q0R3UERJRStuZm5ZczBJZ1U3SkV0OU1DZ1lFQTU0ZWsKTUltWWMyeHhoYTM1U25qd0ZCeEVwSUF3ZGdvdXBROWVsMHhmVVRkdTJsUnA1NHVZaVFVWURhNjJ6RE1kL21QagppSTdqaGl6TEU4VmU4OWh6QXljeTNIRVJPSHNETkhQVG5WN0phcmp3T29aWWIvRnM2NkxtazZMY05BbGI3TER6Cm5FNGdkTEt0cWpQVnBMbmF1T3VOQitXQzY5bm9xRUZpZWxnUWVGc0NnWUIxZGk0RnBYTFlReEZZem9JbHJPOTYKTW1FL0ZueEFJZXdOUEtRNUJnbEJaaVdWRXYrQitrRzZnOWo5NzVTOEl5OUxsR3F5bytjcTl5UUN6K2tLN0pObwozWldCMTJnMmRucGZnNm8zM25LMUpaY0FFVHBVdkwzanZvbFFDQjZCclV1RHozSTlQWE5BNzJEdGROSmVvV254CnJpQWxaU09wQzlSNm1OM3l2UHJTNHdLQmdCQS9WWWRPY0pOUS9kcHFyZjdLNDlZVmNiKzFlekVkWDg2WGVJVFgKaUN6VDNnU1dQZVJReUlCOUNnWVR4NklteUNrTTYyK3V6MHFnSkJRY0dxQzBCTVlvM3duWEtXVTBSTEpPbW9BRgpvYzdLY1prNXlrVDR4VEwzK0lSTnZuUXNYL1lKS045RUlFVHdNUDJycTRkbXYzR1FuaEg2eWlndzM0SEhMTmozCkN4alhBb0dBSjBUNkN0c1c2dEVpYUI5bnc4enI3M2xkMDhraDZSL3B4VHF5c2diNERFTmptd2dndUFoMlJSZkwKYVg3eTNqSUNOTFBjWEFOYlB0QmYrQkRBTTl0UTEzMk5hYzg3N016RHRVSyswem9CWWtwWGM4Rkd4akVuTzc5RQp2MC9vT2wzR2RaWnNJSXhLblcvVlVmYjJydGY1RWgyQytOY1FpWkNXZm5kWkthMXR4WjQ9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

tests/secret-pass.yaml

@@ -0,0 +1,38 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: example
+stringData:
+    EXAMPLE: ENC[AES256_GCM,data:Y4nfpPpucxeNpAAMMePkhwia1QicYay1JEOOf2jrSmov0UGXZfndgXJmt7snzmxkqyHFoZX8N+Cpv6pEhu2BzUiKaAt85V2ugq9y4WWmNj4suNAroP4bvS0eC+lB3xc92wDFOjh7ogZyuykYA3sQTlSjOoA+Z1uhQMMoaoQu,iv:xrMWtO7aPHr9q2MX9i1jEUpZMtkcSs0KHLtNvEhyH9k=,tag:rloLPaXG9j5fB7R/Cbzuzg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2021-04-13T00:49:47Z"
+    mac: ENC[AES256_GCM,data:c+LD6ZbMjpKLrV2XsG4pz3f88ZwQ0xYNDis+cqvPzCIun517SqaXLQo6FR3FRjj+5H/fhYShTwhBjYxFM0Axfe3ccpamELrCmCOeOSABI1EvOph1VsL5fL6MhxBKUV02I3FHjwCWPSNI3T2GTIuKyEzEzQ/uzHbBisVZ0L+j81k=,iv:Vr4VBIfJrcbEFZjJJc4j8Zk128qMQ23xlafHTyZAp84=,tag:IF93M1sFQcCD8p6u0gqzlQ==,type:str]
+    pgp:
+        - created_at: "2021-04-12T17:08:42Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwfpRihAg/tGARAA0XXtTCCkZjUccud57VF8vqqen1K+YJIKXAkALQ7m+NvQ
+            sqtnMEzXB5+eeT0ne35YZIEYiP8BCnQycn4YCxg3tl7uqIe+jCxt/gtzvJlt5xMS
+            skjI3OWDfRuuMMQQqzeRQwbiwT0qUd199opb1TBXV3doSvpvhqwUapJ5+eum+Swy
+            x0bb+x+dqpZw5AZf1dhVYN/KTACHkrlOgFVlldI4RYIt/0yBLg5gb4oco2oJQLhM
+            NpqorNXe/qt4L21v3ZdH3relXQbIFnjv0fIIWfsSSbpJYvWFGbr8p8bMZ8fdMiIE
+            siDP03DfsXi0KhrDV88hBPg9eYjnRvGzZGWyUY1DZVIb6Lx689YEveXgHxoMhaH/
+            XWgiYm616ZrqhKEfurqKSxdZqqe64CxR0wnrMXEIrYpoi98Pxu9dfuVAWTowtBma
+            ufIm9bRUWOclJUt7LnZ0eXL6h6/HvPXVdlaCiYhc7WjW3VdCJsf2Te5ADIwSP6UZ
+            yQEWmXJBxDkPbos74c3oPEmf+UzH4BNx2azq+lwEBFF/LsMez+fz0B2cdE6RL9Ub
+            418C64rQks3OyXDHanRXAEX+CpyKqOAM1+ag/rR/tcOtInQtcH5RmS4ahSEXSOLx
+            17u9lZQs3XbAudrv8ZSYSYRmhhcPF4EutR6etg+rl7+eX3UZ4c4rlH8zjekBNzbS
+            XAEEbNB8h8A2cqi/h3AaEjn5jwMbWXWDwAn9cMpKsX7q1eKDjF1sKOYPjenxWFGC
+            ufN7XNIW5gxfIV3MAS04L37RAy/G5hYpigwbP2xDGUgJqYSAecfNV0uiDRkj
+            =r1XG
+            -----END PGP MESSAGE-----
+          fp: 673F9E296113BAE74D9954A2A92853A46EA01574
+    encrypted_regex: ((?i)(pass|secret($|[^N])|key|token|^data$|^stringData))
+    version: 3.7.1

tests/secret-pass.yml

@@ -0,0 +1,40 @@
+# yamllint disable
+apiVersion: ENC[AES256_GCM,data:EB4=,iv:OmAbqRBqdMhIyBFpaAvxGmEQYaZjLijMPEo5ZYc0ySU=,tag:vDfHvfO/WIFXM+hxHPVZFA==,type:str]
+data:
+    password: ENC[AES256_GCM,data:mTRYYopHASkVUB2E,iv:JacQOg+UMokmgnf8x7UM7sBT6zfqdVPXNYaBmbel094=,tag:nLDJp9DD8u8KJoP+0eV/Cw==,type:str]
+    user: ENC[AES256_GCM,data:esGa8mFfoso=,iv:AvYQ6esRdHgHoLdFWUWNCjMg29D6BYZnrCRQ8Y5GsjY=,tag:3LUeuLG7pxpgLBZYfn68xg==,type:str]
+kind: ENC[AES256_GCM,data:jSSHvCrN,iv:TugXD0VM+DSuj8T8kI0J4KJC7CDSDoJ7x51ZYBs+pCw=,tag:t0SMsdjbJ2+ITayIdFSuJA==,type:str]
+metadata:
+    creationTimestamp: null
+    name: ENC[AES256_GCM,data:/Axsfljw/5ppcQ==,iv:SSrGABB8b4DP1x+6gNig5epkr5zvFcJbEyMiVDhIPPc=,tag:SZsiRFh73gRo7HoI36DbsA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2021-04-13T12:33:20Z"
+    mac: ENC[AES256_GCM,data:AEU+d6nM5PYEu5m+xPrDGWf8JQA47is0o6yAXoL05Hv5FKAhacmuOEvrze+W3yb/v68rj5i4BT3EuLkLm70cWw+WqLsugtjaWcdOvGCTyFEBMyPKfp4cBtGhF/X+iVsB0i9hhfOwZkZ1EtCTwVTjGfGvg+YX1rz+9ZGgg1EGpGA=,iv:T86Jgobt/Ov554hsZQKvGdcEitNUU75oZuzU1ItMWMs=,tag:pA8co3VkKgCGCrKzYRlcyQ==,type:str]
+    pgp:
+        - created_at: "2021-04-13T12:33:19Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA//CYHpV/IETAQ/+N1fzCqcfxnChiwfig6gE8bNJZ6RSyYhsl9iDK1ePQIPj
+            93ulRKK2y7741ylPBB4tRXTD8rEYC97VkNSN291CFC818jhFad8L5qiQfcesmUB/
+            tl8HnX8MsRb2rjn2PlEugL5XqmXtDCFCMZ1T2RAX1zpN34BUCDTTdD0kzXgwDHZL
+            KRB6rWwnG3SEmxzMcq5Nev+E3m5Be8BggFOMzy7Mdb/NDyNybV/dyOz8RhgLrfFx
+            qUG7E7tWWVMksLfs4PB3JkysTRhSJpy2VV2FpaxqIFsTHLVFxM587b64b/yqmpGY
+            f8pOw4heItbgtHrFOXjLhMwZYHBnSEdimGq/V13dr7XTmvU8w4pytU8cUSJ/UhVZ
+            IdVUbHQo0Yw+947wjDWVVn2XsixNn5vyn2ffMdvngL5QLrVL5tlqNTKElStDRpWj
+            0/+yt/bXBP7m8OeEicAwaLLMHCix41oWe950/MM/peEB6giS2ONnh28zv12D05ub
+            JNgON00+6AJQE5ztlxNORtND9miXGOGqk1P27BQWy7cOd1cQMHgTCB1RmPkfqApD
+            1lzO2JHfoFDlbRmWJAkoCQnSONut7pwlQMoyh1iEA0LPCkuqaHrNEXkQZh5S3ubT
+            wcgrU2OV+SUpUkTXTFlRNCLucFufnelsAvSAMNVyiJM8fHQ0hTC9ttMqSsWm2n3S
+            XgEXnY4f2yXApFS+LYWmht+ENrl44u8WMFHShc+h+URnqcMX1DaxnEzUW1BC+ykV
+            5Q8jN0acUstjvP4VnGDCihI/+ADQ2f/TKDOcUP80xf3PLTqQiXL3AnvZsisWAAk=
+            =G3Gh
+            -----END PGP MESSAGE-----
+          fp: A54D8FB506C103352E67737587CB975CFF2E7D8F
+    unencrypted_suffix: _unencrypted
+    version: 3.7.1