kubekrypt 2.0.1 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/ci.yml +1 -1
- data/CHANGELOG.md +11 -0
- data/Gemfile +8 -9
- data/Gemfile.lock +100 -80
- data/Rakefile +5 -6
- data/exe/kubekrypt +1 -1
- data/kubekrypt.gemspec +19 -18
- data/lib/kubekrypt/cli.rb +8 -7
- data/lib/kubekrypt/decryptor.rb +3 -3
- data/lib/kubekrypt/encryptor.rb +4 -4
- data/lib/kubekrypt/version.rb +1 -1
- data/lib/kubekrypt.rb +12 -12
- metadata +20 -6
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: aafcb114c98241aef71fcd5bb8cc2da885720fe50ef89d6986595a86108e6066
|
|
4
|
+
data.tar.gz: 5b4acdd48ddbf46aad74fa089c7c5de1a1d219c924836a9edf4ab528d38c389d
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 5b093a42bfaae3bf5dc63956c38c4ad454c87a5c91d56be298550a7c8bfc11ce9ff6403da1c8a6eddafcc415e1791a0889f8cb3c02c60faa7a76cf4dfdf936cd
|
|
7
|
+
data.tar.gz: 145e1b546e18b9540273025e809f70fac4051c0b21a2d7d7e9739dbec7fed9bfa434812e6cfc340e33f1aff7ce972f41796c8c8aceff5575817a376102b5364e
|
data/.github/workflows/ci.yml
CHANGED
data/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,16 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [2.1.0] - 2026-03-24
|
|
4
|
+
|
|
5
|
+
### Changed
|
|
6
|
+
- Migrated from RuboCop to StandardRB
|
|
7
|
+
- Added Ruby 4.0 support
|
|
8
|
+
|
|
9
|
+
## [2.0.2] - 2025-07-28
|
|
10
|
+
|
|
11
|
+
### Added
|
|
12
|
+
- Lock `grpc`, since 1.74.0 is problematic
|
|
13
|
+
|
|
3
14
|
## [2.0.1] - 2025-03-21
|
|
4
15
|
|
|
5
16
|
### Added
|
data/Gemfile
CHANGED
|
@@ -1,12 +1,11 @@
|
|
|
1
|
-
source
|
|
1
|
+
source "https://rubygems.org"
|
|
2
2
|
|
|
3
3
|
gemspec
|
|
4
4
|
|
|
5
|
-
gem
|
|
6
|
-
gem
|
|
7
|
-
gem
|
|
8
|
-
gem
|
|
9
|
-
gem
|
|
10
|
-
gem
|
|
11
|
-
gem
|
|
12
|
-
gem 'rubocop-rspec'
|
|
5
|
+
gem "bundler"
|
|
6
|
+
gem "irb"
|
|
7
|
+
gem "pry"
|
|
8
|
+
gem "rake"
|
|
9
|
+
gem "rspec"
|
|
10
|
+
gem "standardrb"
|
|
11
|
+
gem "rdoc"
|
data/Gemfile.lock
CHANGED
|
@@ -1,36 +1,38 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
kubekrypt (2.0
|
|
4
|
+
kubekrypt (2.1.0)
|
|
5
5
|
google-cloud-kms
|
|
6
|
-
|
|
6
|
+
grpc (< 1.74.0)
|
|
7
|
+
thor (>= 1.0)
|
|
7
8
|
yaml
|
|
8
9
|
|
|
9
10
|
GEM
|
|
10
11
|
remote: https://rubygems.org/
|
|
11
12
|
specs:
|
|
12
|
-
addressable (2.8.
|
|
13
|
-
public_suffix (>= 2.0.2, <
|
|
13
|
+
addressable (2.8.9)
|
|
14
|
+
public_suffix (>= 2.0.2, < 8.0)
|
|
14
15
|
ast (2.4.3)
|
|
15
|
-
base64 (0.
|
|
16
|
-
bigdecimal (
|
|
16
|
+
base64 (0.3.0)
|
|
17
|
+
bigdecimal (4.0.1)
|
|
17
18
|
coderay (1.1.3)
|
|
18
|
-
date (3.
|
|
19
|
-
diff-lcs (1.6.
|
|
20
|
-
|
|
19
|
+
date (3.5.1)
|
|
20
|
+
diff-lcs (1.6.2)
|
|
21
|
+
erb (6.0.2)
|
|
22
|
+
faraday (2.14.1)
|
|
21
23
|
faraday-net_http (>= 2.0, < 3.5)
|
|
22
24
|
json
|
|
23
25
|
logger
|
|
24
|
-
faraday-net_http (3.4.
|
|
25
|
-
net-http (
|
|
26
|
-
faraday-retry (2.
|
|
26
|
+
faraday-net_http (3.4.2)
|
|
27
|
+
net-http (~> 0.5)
|
|
28
|
+
faraday-retry (2.4.0)
|
|
27
29
|
faraday (~> 2.0)
|
|
28
|
-
gapic-common (
|
|
30
|
+
gapic-common (1.3.0)
|
|
29
31
|
faraday (>= 1.9, < 3.a)
|
|
30
32
|
faraday-retry (>= 1.0, < 3.a)
|
|
31
33
|
google-cloud-env (~> 2.2)
|
|
32
34
|
google-logging-utils (~> 0.1)
|
|
33
|
-
google-protobuf (
|
|
35
|
+
google-protobuf (~> 4.26)
|
|
34
36
|
googleapis-common-protos (~> 1.6)
|
|
35
37
|
googleapis-common-protos-types (~> 1.15)
|
|
36
38
|
googleauth (~> 1.12)
|
|
@@ -38,102 +40,107 @@ GEM
|
|
|
38
40
|
google-cloud-core (1.8.0)
|
|
39
41
|
google-cloud-env (>= 1.0, < 3.a)
|
|
40
42
|
google-cloud-errors (~> 1.0)
|
|
41
|
-
google-cloud-env (2.
|
|
43
|
+
google-cloud-env (2.3.1)
|
|
42
44
|
base64 (~> 0.2)
|
|
43
45
|
faraday (>= 1.0, < 3.a)
|
|
44
|
-
google-cloud-errors (1.
|
|
45
|
-
google-cloud-kms (2.
|
|
46
|
+
google-cloud-errors (1.6.0)
|
|
47
|
+
google-cloud-kms (2.11.0)
|
|
46
48
|
google-cloud-core (~> 1.6)
|
|
47
49
|
google-cloud-kms-v1 (>= 0.26, < 2.a)
|
|
48
|
-
google-cloud-kms-v1 (1.
|
|
49
|
-
gapic-common (
|
|
50
|
+
google-cloud-kms-v1 (1.11.0)
|
|
51
|
+
gapic-common (~> 1.2)
|
|
50
52
|
google-cloud-errors (~> 1.0)
|
|
51
|
-
google-cloud-location (
|
|
52
|
-
google-iam-v1 (
|
|
53
|
-
google-cloud-location (
|
|
54
|
-
gapic-common (
|
|
53
|
+
google-cloud-location (~> 1.0)
|
|
54
|
+
google-iam-v1 (~> 1.3)
|
|
55
|
+
google-cloud-location (1.3.0)
|
|
56
|
+
gapic-common (~> 1.2)
|
|
55
57
|
google-cloud-errors (~> 1.0)
|
|
56
|
-
google-iam-v1 (1.
|
|
57
|
-
gapic-common (
|
|
58
|
+
google-iam-v1 (1.5.1)
|
|
59
|
+
gapic-common (~> 1.2)
|
|
58
60
|
google-cloud-errors (~> 1.0)
|
|
59
|
-
grpc-google-iam-v1 (~> 1.
|
|
60
|
-
google-logging-utils (0.
|
|
61
|
-
google-protobuf (4.
|
|
61
|
+
grpc-google-iam-v1 (~> 1.11)
|
|
62
|
+
google-logging-utils (0.2.0)
|
|
63
|
+
google-protobuf (4.34.1)
|
|
62
64
|
bigdecimal
|
|
63
|
-
rake (
|
|
65
|
+
rake (~> 13.3)
|
|
64
66
|
googleapis-common-protos (1.7.0)
|
|
65
67
|
google-protobuf (>= 3.18, < 5.a)
|
|
66
68
|
googleapis-common-protos-types (~> 1.7)
|
|
67
69
|
grpc (~> 1.41)
|
|
68
|
-
googleapis-common-protos-types (1.
|
|
69
|
-
google-protobuf (
|
|
70
|
-
googleauth (1.
|
|
70
|
+
googleapis-common-protos-types (1.22.0)
|
|
71
|
+
google-protobuf (~> 4.26)
|
|
72
|
+
googleauth (1.16.2)
|
|
71
73
|
faraday (>= 1.0, < 3.a)
|
|
72
74
|
google-cloud-env (~> 2.2)
|
|
73
75
|
google-logging-utils (~> 0.1)
|
|
74
|
-
jwt (>= 1.4, <
|
|
76
|
+
jwt (>= 1.4, < 4.0)
|
|
75
77
|
multi_json (~> 1.11)
|
|
76
78
|
os (>= 0.9, < 2.0)
|
|
77
79
|
signet (>= 0.16, < 2.a)
|
|
78
|
-
grpc (1.
|
|
80
|
+
grpc (1.73.0)
|
|
79
81
|
google-protobuf (>= 3.25, < 5.0)
|
|
80
82
|
googleapis-common-protos-types (~> 1.0)
|
|
81
|
-
grpc-google-iam-v1 (1.
|
|
83
|
+
grpc-google-iam-v1 (1.11.0)
|
|
82
84
|
google-protobuf (>= 3.18, < 5.a)
|
|
83
|
-
googleapis-common-protos (~> 1.
|
|
85
|
+
googleapis-common-protos (~> 1.7.0)
|
|
84
86
|
grpc (~> 1.41)
|
|
85
|
-
io-console (0.8.
|
|
86
|
-
irb (1.
|
|
87
|
+
io-console (0.8.2)
|
|
88
|
+
irb (1.17.0)
|
|
87
89
|
pp (>= 0.6.0)
|
|
90
|
+
prism (>= 1.3.0)
|
|
88
91
|
rdoc (>= 4.0.0)
|
|
89
92
|
reline (>= 0.4.2)
|
|
90
|
-
json (2.
|
|
91
|
-
jwt (
|
|
93
|
+
json (2.19.2)
|
|
94
|
+
jwt (3.1.2)
|
|
92
95
|
base64
|
|
93
|
-
language_server-protocol (3.17.0.
|
|
96
|
+
language_server-protocol (3.17.0.5)
|
|
94
97
|
lint_roller (1.1.0)
|
|
95
|
-
logger (1.
|
|
98
|
+
logger (1.7.0)
|
|
96
99
|
method_source (1.1.0)
|
|
97
|
-
multi_json (1.
|
|
98
|
-
net-http (0.
|
|
99
|
-
uri
|
|
100
|
+
multi_json (1.19.1)
|
|
101
|
+
net-http (0.9.1)
|
|
102
|
+
uri (>= 0.11.1)
|
|
100
103
|
os (1.1.4)
|
|
101
|
-
parallel (1.
|
|
102
|
-
parser (3.3.
|
|
104
|
+
parallel (1.27.0)
|
|
105
|
+
parser (3.3.10.2)
|
|
103
106
|
ast (~> 2.4.1)
|
|
104
107
|
racc
|
|
105
|
-
pp (0.6.
|
|
108
|
+
pp (0.6.3)
|
|
106
109
|
prettyprint
|
|
107
110
|
prettyprint (0.2.0)
|
|
108
|
-
|
|
111
|
+
prism (1.9.0)
|
|
112
|
+
pry (0.16.0)
|
|
109
113
|
coderay (~> 1.1)
|
|
110
114
|
method_source (~> 1.0)
|
|
111
|
-
|
|
115
|
+
reline (>= 0.6.0)
|
|
116
|
+
psych (5.3.1)
|
|
112
117
|
date
|
|
113
118
|
stringio
|
|
114
|
-
public_suffix (
|
|
119
|
+
public_suffix (7.0.5)
|
|
115
120
|
racc (1.8.1)
|
|
116
121
|
rainbow (3.1.1)
|
|
117
|
-
rake (13.
|
|
118
|
-
rdoc (
|
|
122
|
+
rake (13.3.1)
|
|
123
|
+
rdoc (7.2.0)
|
|
124
|
+
erb
|
|
119
125
|
psych (>= 4.0.0)
|
|
120
|
-
|
|
121
|
-
|
|
126
|
+
tsort
|
|
127
|
+
regexp_parser (2.11.3)
|
|
128
|
+
reline (0.6.3)
|
|
122
129
|
io-console (~> 0.5)
|
|
123
|
-
rspec (3.13.
|
|
130
|
+
rspec (3.13.2)
|
|
124
131
|
rspec-core (~> 3.13.0)
|
|
125
132
|
rspec-expectations (~> 3.13.0)
|
|
126
133
|
rspec-mocks (~> 3.13.0)
|
|
127
|
-
rspec-core (3.13.
|
|
134
|
+
rspec-core (3.13.6)
|
|
128
135
|
rspec-support (~> 3.13.0)
|
|
129
|
-
rspec-expectations (3.13.
|
|
136
|
+
rspec-expectations (3.13.5)
|
|
130
137
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
131
138
|
rspec-support (~> 3.13.0)
|
|
132
|
-
rspec-mocks (3.13.
|
|
139
|
+
rspec-mocks (3.13.8)
|
|
133
140
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
134
141
|
rspec-support (~> 3.13.0)
|
|
135
|
-
rspec-support (3.13.
|
|
136
|
-
rubocop (1.
|
|
142
|
+
rspec-support (3.13.7)
|
|
143
|
+
rubocop (1.84.2)
|
|
137
144
|
json (~> 2.3)
|
|
138
145
|
language_server-protocol (~> 3.17.0.2)
|
|
139
146
|
lint_roller (~> 1.1.0)
|
|
@@ -141,29 +148,43 @@ GEM
|
|
|
141
148
|
parser (>= 3.3.0.2)
|
|
142
149
|
rainbow (>= 2.2.2, < 4.0)
|
|
143
150
|
regexp_parser (>= 2.9.3, < 3.0)
|
|
144
|
-
rubocop-ast (>= 1.
|
|
151
|
+
rubocop-ast (>= 1.49.0, < 2.0)
|
|
145
152
|
ruby-progressbar (~> 1.7)
|
|
146
153
|
unicode-display_width (>= 2.4.0, < 4.0)
|
|
147
|
-
rubocop-ast (1.
|
|
154
|
+
rubocop-ast (1.49.1)
|
|
148
155
|
parser (>= 3.3.7.2)
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
rubocop (>= 1.72.1)
|
|
152
|
-
rubocop-rspec (3.5.0)
|
|
156
|
+
prism (~> 1.7)
|
|
157
|
+
rubocop-performance (1.26.1)
|
|
153
158
|
lint_roller (~> 1.1)
|
|
154
|
-
rubocop (
|
|
159
|
+
rubocop (>= 1.75.0, < 2.0)
|
|
160
|
+
rubocop-ast (>= 1.47.1, < 2.0)
|
|
155
161
|
ruby-progressbar (1.13.0)
|
|
156
|
-
signet (0.
|
|
162
|
+
signet (0.21.0)
|
|
157
163
|
addressable (~> 2.8)
|
|
158
164
|
faraday (>= 0.17.5, < 3.a)
|
|
159
|
-
jwt (>= 1.5, <
|
|
165
|
+
jwt (>= 1.5, < 4.0)
|
|
160
166
|
multi_json (~> 1.10)
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
+
standard (1.54.0)
|
|
168
|
+
language_server-protocol (~> 3.17.0.2)
|
|
169
|
+
lint_roller (~> 1.0)
|
|
170
|
+
rubocop (~> 1.84.0)
|
|
171
|
+
standard-custom (~> 1.0.0)
|
|
172
|
+
standard-performance (~> 1.8)
|
|
173
|
+
standard-custom (1.0.2)
|
|
174
|
+
lint_roller (~> 1.0)
|
|
175
|
+
rubocop (~> 1.50)
|
|
176
|
+
standard-performance (1.9.0)
|
|
177
|
+
lint_roller (~> 1.1)
|
|
178
|
+
rubocop-performance (~> 1.26.0)
|
|
179
|
+
standardrb (1.0.1)
|
|
180
|
+
standard
|
|
181
|
+
stringio (3.2.0)
|
|
182
|
+
thor (1.5.0)
|
|
183
|
+
tsort (0.2.0)
|
|
184
|
+
unicode-display_width (3.2.0)
|
|
185
|
+
unicode-emoji (~> 4.1)
|
|
186
|
+
unicode-emoji (4.2.0)
|
|
187
|
+
uri (1.1.1)
|
|
167
188
|
yaml (0.4.0)
|
|
168
189
|
|
|
169
190
|
PLATFORMS
|
|
@@ -175,10 +196,9 @@ DEPENDENCIES
|
|
|
175
196
|
kubekrypt!
|
|
176
197
|
pry
|
|
177
198
|
rake
|
|
199
|
+
rdoc
|
|
178
200
|
rspec
|
|
179
|
-
|
|
180
|
-
rubocop-rake
|
|
181
|
-
rubocop-rspec
|
|
201
|
+
standardrb
|
|
182
202
|
|
|
183
203
|
BUNDLED WITH
|
|
184
|
-
2.
|
|
204
|
+
2.7.1
|
data/Rakefile
CHANGED
|
@@ -1,9 +1,8 @@
|
|
|
1
|
-
require
|
|
2
|
-
require
|
|
3
|
-
require
|
|
1
|
+
require "bundler/gem_tasks"
|
|
2
|
+
require "rspec/core/rake_task"
|
|
3
|
+
require "standard/rake"
|
|
4
4
|
|
|
5
5
|
RSpec::Core::RakeTask.new(:spec)
|
|
6
|
-
RuboCop::RakeTask.new
|
|
7
6
|
|
|
8
|
-
task ci: %i[spec
|
|
9
|
-
task default: %i[spec
|
|
7
|
+
task ci: %i[spec standard]
|
|
8
|
+
task default: %i[spec standard:fix]
|
data/exe/kubekrypt
CHANGED
data/kubekrypt.gemspec
CHANGED
|
@@ -1,32 +1,33 @@
|
|
|
1
|
-
lib = File.expand_path(
|
|
1
|
+
lib = File.expand_path("lib", __dir__)
|
|
2
2
|
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
|
3
|
-
require
|
|
3
|
+
require "kubekrypt/version"
|
|
4
4
|
|
|
5
5
|
Gem::Specification.new do |spec|
|
|
6
|
-
spec.name =
|
|
6
|
+
spec.name = "kubekrypt"
|
|
7
7
|
spec.version = KubeKrypt::VERSION
|
|
8
|
-
spec.authors = [
|
|
9
|
-
spec.email = [
|
|
8
|
+
spec.authors = ["Krzysztof Knapik"]
|
|
9
|
+
spec.email = ["knapo@knapo.net"]
|
|
10
10
|
|
|
11
|
-
spec.summary =
|
|
12
|
-
spec.homepage =
|
|
13
|
-
spec.license =
|
|
11
|
+
spec.summary = "KubeKrypt provides seamless encryption and decryption of Kubernetes Secret menifests using Google Cloud KMS"
|
|
12
|
+
spec.homepage = "https://github.com/knapo/kubekrypt"
|
|
13
|
+
spec.license = "MIT"
|
|
14
14
|
|
|
15
|
-
spec.metadata[
|
|
16
|
-
spec.metadata[
|
|
17
|
-
spec.metadata[
|
|
18
|
-
spec.metadata[
|
|
15
|
+
spec.metadata["homepage_uri"] = "https://github.com/knapo/kubekrypt"
|
|
16
|
+
spec.metadata["source_code_uri"] = "https://github.com/knapo/kubekrypt"
|
|
17
|
+
spec.metadata["changelog_uri"] = "https://github.com/knapo/kubekrypt/blob/main/CHANGELOG.md"
|
|
18
|
+
spec.metadata["rubygems_mfa_required"] = "true"
|
|
19
19
|
|
|
20
|
-
spec.required_ruby_version = Gem::Requirement.new(
|
|
20
|
+
spec.required_ruby_version = Gem::Requirement.new(">= 3.4")
|
|
21
21
|
|
|
22
22
|
spec.files = Dir.chdir(__dir__) do
|
|
23
23
|
`git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(bin/|spec/|\.rub)}) }
|
|
24
24
|
end
|
|
25
|
-
spec.bindir =
|
|
25
|
+
spec.bindir = "exe"
|
|
26
26
|
spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
|
|
27
|
-
spec.require_paths = [
|
|
27
|
+
spec.require_paths = ["lib"]
|
|
28
28
|
|
|
29
|
-
spec.add_dependency
|
|
30
|
-
spec.add_dependency
|
|
31
|
-
spec.add_dependency
|
|
29
|
+
spec.add_dependency "google-cloud-kms"
|
|
30
|
+
spec.add_dependency "grpc", "< 1.74.0" # 1.74.0 & google-cloud-kms produce segmentation fault errors
|
|
31
|
+
spec.add_dependency "thor", ">= 1.0"
|
|
32
|
+
spec.add_dependency "yaml"
|
|
32
33
|
end
|
data/lib/kubekrypt/cli.rb
CHANGED
|
@@ -1,36 +1,37 @@
|
|
|
1
1
|
module KubeKrypt
|
|
2
2
|
class CLI < Thor
|
|
3
3
|
include Thor::Shell
|
|
4
|
+
|
|
4
5
|
def self.exit_on_failure?
|
|
5
6
|
true
|
|
6
7
|
end
|
|
7
8
|
|
|
8
|
-
desc
|
|
9
|
+
desc "version", "Displays the current version of KubeKrypt"
|
|
9
10
|
def version
|
|
10
11
|
puts KubeKrypt::VERSION
|
|
11
12
|
end
|
|
12
13
|
|
|
13
|
-
method_option KMS_KEY, aliases:
|
|
14
|
-
desc
|
|
14
|
+
method_option KMS_KEY, aliases: "-k", desc: "Google KMS encryption key id to use", required: true
|
|
15
|
+
desc "encrypt FILE", "Encrypts Kubernetes secrets manifest using the specified KMS key"
|
|
15
16
|
def encrypt(file_path)
|
|
16
17
|
yaml_content = File.read(file_path)
|
|
17
18
|
content = YAML.safe_load(yaml_content)
|
|
18
19
|
key_name = options.fetch(KMS_KEY)
|
|
19
20
|
|
|
20
|
-
raise AlreadyEncrytpedError, "#{file_path} is already encrypted" if content[
|
|
21
|
+
raise AlreadyEncrytpedError, "#{file_path} is already encrypted" if content["kubekrypt"]
|
|
21
22
|
|
|
22
23
|
result = KubeKrypt::Encryptor.call(content:, key_name:)
|
|
23
24
|
puts result
|
|
24
25
|
end
|
|
25
26
|
|
|
26
|
-
method_option :base64, desc:
|
|
27
|
-
desc
|
|
27
|
+
method_option :base64, desc: "Base64 encoded values", type: :boolean, required: false
|
|
28
|
+
desc "decrypt FILE", "Decrypts Kubernetes secrets manifest using embedded kubekrypt metadata"
|
|
28
29
|
def decrypt(file_path)
|
|
29
30
|
yaml_content = File.read(file_path)
|
|
30
31
|
content = YAML.safe_load(yaml_content)
|
|
31
32
|
base64 = options.fetch(:base64, false)
|
|
32
33
|
|
|
33
|
-
raise NotEncrytpedError, "#{file_path} is not encrypted" unless content[
|
|
34
|
+
raise NotEncrytpedError, "#{file_path} is not encrypted" unless content["kubekrypt"]
|
|
34
35
|
|
|
35
36
|
result = KubeKrypt::Decryptor.call(content:, base64:)
|
|
36
37
|
puts result
|
data/lib/kubekrypt/decryptor.rb
CHANGED
|
@@ -8,7 +8,7 @@ module KubeKrypt
|
|
|
8
8
|
end
|
|
9
9
|
|
|
10
10
|
def call(encodedtext, base64: false)
|
|
11
|
-
ciphertext = Base64.strict_decode64(encodedtext.sub("#{ENC_PREFIX}:",
|
|
11
|
+
ciphertext = Base64.strict_decode64(encodedtext.sub("#{ENC_PREFIX}:", ""))
|
|
12
12
|
|
|
13
13
|
result = client.decrypt(name: key_name, ciphertext:).plaintext
|
|
14
14
|
|
|
@@ -20,11 +20,11 @@ module KubeKrypt
|
|
|
20
20
|
end
|
|
21
21
|
|
|
22
22
|
def self.call(content:, base64:)
|
|
23
|
-
return content unless content[
|
|
23
|
+
return content unless content["data"]
|
|
24
24
|
|
|
25
25
|
key_name = content.fetch(METADATA_KEY).fetch(KMS_KEY.to_s)
|
|
26
26
|
decryptor = new(key_name)
|
|
27
|
-
content[
|
|
27
|
+
content["data"].transform_values! { |encodedtext| decryptor.call(encodedtext, base64:) }
|
|
28
28
|
content.delete(METADATA_KEY)
|
|
29
29
|
content.to_yaml
|
|
30
30
|
end
|
data/lib/kubekrypt/encryptor.rb
CHANGED
|
@@ -14,16 +14,16 @@ module KubeKrypt
|
|
|
14
14
|
end
|
|
15
15
|
|
|
16
16
|
def self.call(content:, key_name:)
|
|
17
|
-
return content unless content[
|
|
17
|
+
return content unless content["data"]
|
|
18
18
|
|
|
19
19
|
encryptor = new(key_name)
|
|
20
20
|
|
|
21
|
-
content[
|
|
21
|
+
content["data"].transform_values! { |plaintext| encryptor.call(plaintext) }
|
|
22
22
|
|
|
23
23
|
content[METADATA_KEY] = {
|
|
24
24
|
KMS_KEY.to_s => key_name,
|
|
25
|
-
|
|
26
|
-
|
|
25
|
+
"version" => VERSION,
|
|
26
|
+
"modified_at" => Time.now.utc.iso8601
|
|
27
27
|
}
|
|
28
28
|
|
|
29
29
|
content.to_yaml
|
data/lib/kubekrypt/version.rb
CHANGED
data/lib/kubekrypt.rb
CHANGED
|
@@ -1,19 +1,19 @@
|
|
|
1
|
-
require
|
|
2
|
-
require
|
|
3
|
-
require
|
|
4
|
-
require
|
|
5
|
-
require
|
|
1
|
+
require "base64"
|
|
2
|
+
require "google/cloud/kms"
|
|
3
|
+
require "optparse"
|
|
4
|
+
require "thor"
|
|
5
|
+
require "yaml"
|
|
6
6
|
|
|
7
7
|
module KubeKrypt
|
|
8
8
|
AlreadyEncrytpedError = Class.new(StandardError)
|
|
9
9
|
NotEncrytpedError = Class.new(StandardError)
|
|
10
10
|
KMS_KEY = :kms_key
|
|
11
|
-
ENCRYPTION_METHOD =
|
|
12
|
-
METADATA_KEY =
|
|
13
|
-
ENC_PREFIX =
|
|
11
|
+
ENCRYPTION_METHOD = "aes-256-gcm".freeze
|
|
12
|
+
METADATA_KEY = "kubekrypt".freeze
|
|
13
|
+
ENC_PREFIX = "enc".freeze
|
|
14
14
|
end
|
|
15
15
|
|
|
16
|
-
require
|
|
17
|
-
require
|
|
18
|
-
require
|
|
19
|
-
require
|
|
16
|
+
require "kubekrypt/version"
|
|
17
|
+
require "kubekrypt/cli"
|
|
18
|
+
require "kubekrypt/encryptor"
|
|
19
|
+
require "kubekrypt/decryptor"
|
metadata
CHANGED
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: kubekrypt
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 2.0
|
|
4
|
+
version: 2.1.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Krzysztof Knapik
|
|
8
8
|
bindir: exe
|
|
9
9
|
cert_chain: []
|
|
10
|
-
date:
|
|
10
|
+
date: 1980-01-02 00:00:00.000000000 Z
|
|
11
11
|
dependencies:
|
|
12
12
|
- !ruby/object:Gem::Dependency
|
|
13
13
|
name: google-cloud-kms
|
|
@@ -23,18 +23,32 @@ dependencies:
|
|
|
23
23
|
- - ">="
|
|
24
24
|
- !ruby/object:Gem::Version
|
|
25
25
|
version: '0'
|
|
26
|
+
- !ruby/object:Gem::Dependency
|
|
27
|
+
name: grpc
|
|
28
|
+
requirement: !ruby/object:Gem::Requirement
|
|
29
|
+
requirements:
|
|
30
|
+
- - "<"
|
|
31
|
+
- !ruby/object:Gem::Version
|
|
32
|
+
version: 1.74.0
|
|
33
|
+
type: :runtime
|
|
34
|
+
prerelease: false
|
|
35
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
36
|
+
requirements:
|
|
37
|
+
- - "<"
|
|
38
|
+
- !ruby/object:Gem::Version
|
|
39
|
+
version: 1.74.0
|
|
26
40
|
- !ruby/object:Gem::Dependency
|
|
27
41
|
name: thor
|
|
28
42
|
requirement: !ruby/object:Gem::Requirement
|
|
29
43
|
requirements:
|
|
30
|
-
- - "
|
|
44
|
+
- - ">="
|
|
31
45
|
- !ruby/object:Gem::Version
|
|
32
46
|
version: '1.0'
|
|
33
47
|
type: :runtime
|
|
34
48
|
prerelease: false
|
|
35
49
|
version_requirements: !ruby/object:Gem::Requirement
|
|
36
50
|
requirements:
|
|
37
|
-
- - "
|
|
51
|
+
- - ">="
|
|
38
52
|
- !ruby/object:Gem::Version
|
|
39
53
|
version: '1.0'
|
|
40
54
|
- !ruby/object:Gem::Dependency
|
|
@@ -89,14 +103,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
89
103
|
requirements:
|
|
90
104
|
- - ">="
|
|
91
105
|
- !ruby/object:Gem::Version
|
|
92
|
-
version: 3.4
|
|
106
|
+
version: '3.4'
|
|
93
107
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
94
108
|
requirements:
|
|
95
109
|
- - ">="
|
|
96
110
|
- !ruby/object:Gem::Version
|
|
97
111
|
version: '0'
|
|
98
112
|
requirements: []
|
|
99
|
-
rubygems_version:
|
|
113
|
+
rubygems_version: 4.0.8
|
|
100
114
|
specification_version: 4
|
|
101
115
|
summary: KubeKrypt provides seamless encryption and decryption of Kubernetes Secret
|
|
102
116
|
menifests using Google Cloud KMS
|