kubekrypt 2.0.2 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/ci.yml +1 -1
- data/CHANGELOG.md +6 -0
- data/Gemfile +8 -9
- data/Gemfile.lock +82 -69
- data/Rakefile +5 -6
- data/exe/kubekrypt +1 -1
- data/kubekrypt.gemspec +19 -19
- data/lib/kubekrypt/cli.rb +7 -7
- data/lib/kubekrypt/decryptor.rb +3 -3
- data/lib/kubekrypt/encryptor.rb +4 -4
- data/lib/kubekrypt/version.rb +1 -1
- data/lib/kubekrypt.rb +12 -12
- metadata +3 -3
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: aafcb114c98241aef71fcd5bb8cc2da885720fe50ef89d6986595a86108e6066
|
|
4
|
+
data.tar.gz: 5b4acdd48ddbf46aad74fa089c7c5de1a1d219c924836a9edf4ab528d38c389d
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 5b093a42bfaae3bf5dc63956c38c4ad454c87a5c91d56be298550a7c8bfc11ce9ff6403da1c8a6eddafcc415e1791a0889f8cb3c02c60faa7a76cf4dfdf936cd
|
|
7
|
+
data.tar.gz: 145e1b546e18b9540273025e809f70fac4051c0b21a2d7d7e9739dbec7fed9bfa434812e6cfc340e33f1aff7ce972f41796c8c8aceff5575817a376102b5364e
|
data/.github/workflows/ci.yml
CHANGED
data/CHANGELOG.md
CHANGED
data/Gemfile
CHANGED
|
@@ -1,12 +1,11 @@
|
|
|
1
|
-
source
|
|
1
|
+
source "https://rubygems.org"
|
|
2
2
|
|
|
3
3
|
gemspec
|
|
4
4
|
|
|
5
|
-
gem
|
|
6
|
-
gem
|
|
7
|
-
gem
|
|
8
|
-
gem
|
|
9
|
-
gem
|
|
10
|
-
gem
|
|
11
|
-
gem
|
|
12
|
-
gem 'rubocop-rspec'
|
|
5
|
+
gem "bundler"
|
|
6
|
+
gem "irb"
|
|
7
|
+
gem "pry"
|
|
8
|
+
gem "rake"
|
|
9
|
+
gem "rspec"
|
|
10
|
+
gem "standardrb"
|
|
11
|
+
gem "rdoc"
|
data/Gemfile.lock
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
kubekrypt (2.0
|
|
4
|
+
kubekrypt (2.1.0)
|
|
5
5
|
google-cloud-kms
|
|
6
6
|
grpc (< 1.74.0)
|
|
7
7
|
thor (>= 1.0)
|
|
@@ -10,29 +10,29 @@ PATH
|
|
|
10
10
|
GEM
|
|
11
11
|
remote: https://rubygems.org/
|
|
12
12
|
specs:
|
|
13
|
-
addressable (2.8.
|
|
14
|
-
public_suffix (>= 2.0.2, <
|
|
13
|
+
addressable (2.8.9)
|
|
14
|
+
public_suffix (>= 2.0.2, < 8.0)
|
|
15
15
|
ast (2.4.3)
|
|
16
16
|
base64 (0.3.0)
|
|
17
|
-
bigdecimal (
|
|
17
|
+
bigdecimal (4.0.1)
|
|
18
18
|
coderay (1.1.3)
|
|
19
|
-
date (3.
|
|
19
|
+
date (3.5.1)
|
|
20
20
|
diff-lcs (1.6.2)
|
|
21
|
-
erb (
|
|
22
|
-
faraday (2.
|
|
21
|
+
erb (6.0.2)
|
|
22
|
+
faraday (2.14.1)
|
|
23
23
|
faraday-net_http (>= 2.0, < 3.5)
|
|
24
24
|
json
|
|
25
25
|
logger
|
|
26
|
-
faraday-net_http (3.4.
|
|
27
|
-
net-http (
|
|
28
|
-
faraday-retry (2.
|
|
26
|
+
faraday-net_http (3.4.2)
|
|
27
|
+
net-http (~> 0.5)
|
|
28
|
+
faraday-retry (2.4.0)
|
|
29
29
|
faraday (~> 2.0)
|
|
30
|
-
gapic-common (1.0
|
|
30
|
+
gapic-common (1.3.0)
|
|
31
31
|
faraday (>= 1.9, < 3.a)
|
|
32
32
|
faraday-retry (>= 1.0, < 3.a)
|
|
33
33
|
google-cloud-env (~> 2.2)
|
|
34
34
|
google-logging-utils (~> 0.1)
|
|
35
|
-
google-protobuf (
|
|
35
|
+
google-protobuf (~> 4.26)
|
|
36
36
|
googleapis-common-protos (~> 1.6)
|
|
37
37
|
googleapis-common-protos-types (~> 1.15)
|
|
38
38
|
googleauth (~> 1.12)
|
|
@@ -43,37 +43,37 @@ GEM
|
|
|
43
43
|
google-cloud-env (2.3.1)
|
|
44
44
|
base64 (~> 0.2)
|
|
45
45
|
faraday (>= 1.0, < 3.a)
|
|
46
|
-
google-cloud-errors (1.
|
|
47
|
-
google-cloud-kms (2.
|
|
46
|
+
google-cloud-errors (1.6.0)
|
|
47
|
+
google-cloud-kms (2.11.0)
|
|
48
48
|
google-cloud-core (~> 1.6)
|
|
49
49
|
google-cloud-kms-v1 (>= 0.26, < 2.a)
|
|
50
|
-
google-cloud-kms-v1 (1.
|
|
51
|
-
gapic-common (~> 1.
|
|
50
|
+
google-cloud-kms-v1 (1.11.0)
|
|
51
|
+
gapic-common (~> 1.2)
|
|
52
52
|
google-cloud-errors (~> 1.0)
|
|
53
53
|
google-cloud-location (~> 1.0)
|
|
54
54
|
google-iam-v1 (~> 1.3)
|
|
55
|
-
google-cloud-location (1.
|
|
56
|
-
gapic-common (~> 1.
|
|
55
|
+
google-cloud-location (1.3.0)
|
|
56
|
+
gapic-common (~> 1.2)
|
|
57
57
|
google-cloud-errors (~> 1.0)
|
|
58
|
-
google-iam-v1 (1.
|
|
59
|
-
gapic-common (~> 1.
|
|
58
|
+
google-iam-v1 (1.5.1)
|
|
59
|
+
gapic-common (~> 1.2)
|
|
60
60
|
google-cloud-errors (~> 1.0)
|
|
61
61
|
grpc-google-iam-v1 (~> 1.11)
|
|
62
62
|
google-logging-utils (0.2.0)
|
|
63
|
-
google-protobuf (4.
|
|
63
|
+
google-protobuf (4.34.1)
|
|
64
64
|
bigdecimal
|
|
65
|
-
rake (
|
|
65
|
+
rake (~> 13.3)
|
|
66
66
|
googleapis-common-protos (1.7.0)
|
|
67
67
|
google-protobuf (>= 3.18, < 5.a)
|
|
68
68
|
googleapis-common-protos-types (~> 1.7)
|
|
69
69
|
grpc (~> 1.41)
|
|
70
|
-
googleapis-common-protos-types (1.
|
|
71
|
-
google-protobuf (
|
|
72
|
-
googleauth (1.
|
|
70
|
+
googleapis-common-protos-types (1.22.0)
|
|
71
|
+
google-protobuf (~> 4.26)
|
|
72
|
+
googleauth (1.16.2)
|
|
73
73
|
faraday (>= 1.0, < 3.a)
|
|
74
74
|
google-cloud-env (~> 2.2)
|
|
75
75
|
google-logging-utils (~> 0.1)
|
|
76
|
-
jwt (>= 1.4, <
|
|
76
|
+
jwt (>= 1.4, < 4.0)
|
|
77
77
|
multi_json (~> 1.11)
|
|
78
78
|
os (>= 0.9, < 2.0)
|
|
79
79
|
signet (>= 0.16, < 2.a)
|
|
@@ -84,60 +84,63 @@ GEM
|
|
|
84
84
|
google-protobuf (>= 3.18, < 5.a)
|
|
85
85
|
googleapis-common-protos (~> 1.7.0)
|
|
86
86
|
grpc (~> 1.41)
|
|
87
|
-
io-console (0.8.
|
|
88
|
-
irb (1.
|
|
87
|
+
io-console (0.8.2)
|
|
88
|
+
irb (1.17.0)
|
|
89
89
|
pp (>= 0.6.0)
|
|
90
|
+
prism (>= 1.3.0)
|
|
90
91
|
rdoc (>= 4.0.0)
|
|
91
92
|
reline (>= 0.4.2)
|
|
92
|
-
json (2.
|
|
93
|
-
jwt (
|
|
93
|
+
json (2.19.2)
|
|
94
|
+
jwt (3.1.2)
|
|
94
95
|
base64
|
|
95
96
|
language_server-protocol (3.17.0.5)
|
|
96
97
|
lint_roller (1.1.0)
|
|
97
98
|
logger (1.7.0)
|
|
98
99
|
method_source (1.1.0)
|
|
99
|
-
multi_json (1.
|
|
100
|
-
net-http (0.
|
|
101
|
-
uri
|
|
100
|
+
multi_json (1.19.1)
|
|
101
|
+
net-http (0.9.1)
|
|
102
|
+
uri (>= 0.11.1)
|
|
102
103
|
os (1.1.4)
|
|
103
104
|
parallel (1.27.0)
|
|
104
|
-
parser (3.3.
|
|
105
|
+
parser (3.3.10.2)
|
|
105
106
|
ast (~> 2.4.1)
|
|
106
107
|
racc
|
|
107
|
-
pp (0.6.
|
|
108
|
+
pp (0.6.3)
|
|
108
109
|
prettyprint
|
|
109
110
|
prettyprint (0.2.0)
|
|
110
|
-
prism (1.
|
|
111
|
-
pry (0.
|
|
111
|
+
prism (1.9.0)
|
|
112
|
+
pry (0.16.0)
|
|
112
113
|
coderay (~> 1.1)
|
|
113
114
|
method_source (~> 1.0)
|
|
114
|
-
|
|
115
|
+
reline (>= 0.6.0)
|
|
116
|
+
psych (5.3.1)
|
|
115
117
|
date
|
|
116
118
|
stringio
|
|
117
|
-
public_suffix (
|
|
119
|
+
public_suffix (7.0.5)
|
|
118
120
|
racc (1.8.1)
|
|
119
121
|
rainbow (3.1.1)
|
|
120
|
-
rake (13.3.
|
|
121
|
-
rdoc (
|
|
122
|
+
rake (13.3.1)
|
|
123
|
+
rdoc (7.2.0)
|
|
122
124
|
erb
|
|
123
125
|
psych (>= 4.0.0)
|
|
124
|
-
|
|
125
|
-
|
|
126
|
+
tsort
|
|
127
|
+
regexp_parser (2.11.3)
|
|
128
|
+
reline (0.6.3)
|
|
126
129
|
io-console (~> 0.5)
|
|
127
|
-
rspec (3.13.
|
|
130
|
+
rspec (3.13.2)
|
|
128
131
|
rspec-core (~> 3.13.0)
|
|
129
132
|
rspec-expectations (~> 3.13.0)
|
|
130
133
|
rspec-mocks (~> 3.13.0)
|
|
131
|
-
rspec-core (3.13.
|
|
134
|
+
rspec-core (3.13.6)
|
|
132
135
|
rspec-support (~> 3.13.0)
|
|
133
136
|
rspec-expectations (3.13.5)
|
|
134
137
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
135
138
|
rspec-support (~> 3.13.0)
|
|
136
|
-
rspec-mocks (3.13.
|
|
139
|
+
rspec-mocks (3.13.8)
|
|
137
140
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
138
141
|
rspec-support (~> 3.13.0)
|
|
139
|
-
rspec-support (3.13.
|
|
140
|
-
rubocop (1.
|
|
142
|
+
rspec-support (3.13.7)
|
|
143
|
+
rubocop (1.84.2)
|
|
141
144
|
json (~> 2.3)
|
|
142
145
|
language_server-protocol (~> 3.17.0.2)
|
|
143
146
|
lint_roller (~> 1.1.0)
|
|
@@ -145,32 +148,43 @@ GEM
|
|
|
145
148
|
parser (>= 3.3.0.2)
|
|
146
149
|
rainbow (>= 2.2.2, < 4.0)
|
|
147
150
|
regexp_parser (>= 2.9.3, < 3.0)
|
|
148
|
-
rubocop-ast (>= 1.
|
|
151
|
+
rubocop-ast (>= 1.49.0, < 2.0)
|
|
149
152
|
ruby-progressbar (~> 1.7)
|
|
150
|
-
tsort (>= 0.2.0)
|
|
151
153
|
unicode-display_width (>= 2.4.0, < 4.0)
|
|
152
|
-
rubocop-ast (1.
|
|
154
|
+
rubocop-ast (1.49.1)
|
|
153
155
|
parser (>= 3.3.7.2)
|
|
154
|
-
prism (~> 1.
|
|
155
|
-
rubocop-
|
|
156
|
-
lint_roller (~> 1.1)
|
|
157
|
-
rubocop (>= 1.72.1)
|
|
158
|
-
rubocop-rspec (3.6.0)
|
|
156
|
+
prism (~> 1.7)
|
|
157
|
+
rubocop-performance (1.26.1)
|
|
159
158
|
lint_roller (~> 1.1)
|
|
160
|
-
rubocop (
|
|
159
|
+
rubocop (>= 1.75.0, < 2.0)
|
|
160
|
+
rubocop-ast (>= 1.47.1, < 2.0)
|
|
161
161
|
ruby-progressbar (1.13.0)
|
|
162
|
-
signet (0.
|
|
162
|
+
signet (0.21.0)
|
|
163
163
|
addressable (~> 2.8)
|
|
164
164
|
faraday (>= 0.17.5, < 3.a)
|
|
165
|
-
jwt (>= 1.5, <
|
|
165
|
+
jwt (>= 1.5, < 4.0)
|
|
166
166
|
multi_json (~> 1.10)
|
|
167
|
-
|
|
168
|
-
|
|
167
|
+
standard (1.54.0)
|
|
168
|
+
language_server-protocol (~> 3.17.0.2)
|
|
169
|
+
lint_roller (~> 1.0)
|
|
170
|
+
rubocop (~> 1.84.0)
|
|
171
|
+
standard-custom (~> 1.0.0)
|
|
172
|
+
standard-performance (~> 1.8)
|
|
173
|
+
standard-custom (1.0.2)
|
|
174
|
+
lint_roller (~> 1.0)
|
|
175
|
+
rubocop (~> 1.50)
|
|
176
|
+
standard-performance (1.9.0)
|
|
177
|
+
lint_roller (~> 1.1)
|
|
178
|
+
rubocop-performance (~> 1.26.0)
|
|
179
|
+
standardrb (1.0.1)
|
|
180
|
+
standard
|
|
181
|
+
stringio (3.2.0)
|
|
182
|
+
thor (1.5.0)
|
|
169
183
|
tsort (0.2.0)
|
|
170
|
-
unicode-display_width (3.
|
|
171
|
-
unicode-emoji (~> 4.
|
|
172
|
-
unicode-emoji (4.0
|
|
173
|
-
uri (1.
|
|
184
|
+
unicode-display_width (3.2.0)
|
|
185
|
+
unicode-emoji (~> 4.1)
|
|
186
|
+
unicode-emoji (4.2.0)
|
|
187
|
+
uri (1.1.1)
|
|
174
188
|
yaml (0.4.0)
|
|
175
189
|
|
|
176
190
|
PLATFORMS
|
|
@@ -182,10 +196,9 @@ DEPENDENCIES
|
|
|
182
196
|
kubekrypt!
|
|
183
197
|
pry
|
|
184
198
|
rake
|
|
199
|
+
rdoc
|
|
185
200
|
rspec
|
|
186
|
-
|
|
187
|
-
rubocop-rake
|
|
188
|
-
rubocop-rspec
|
|
201
|
+
standardrb
|
|
189
202
|
|
|
190
203
|
BUNDLED WITH
|
|
191
|
-
2.
|
|
204
|
+
2.7.1
|
data/Rakefile
CHANGED
|
@@ -1,9 +1,8 @@
|
|
|
1
|
-
require
|
|
2
|
-
require
|
|
3
|
-
require
|
|
1
|
+
require "bundler/gem_tasks"
|
|
2
|
+
require "rspec/core/rake_task"
|
|
3
|
+
require "standard/rake"
|
|
4
4
|
|
|
5
5
|
RSpec::Core::RakeTask.new(:spec)
|
|
6
|
-
RuboCop::RakeTask.new
|
|
7
6
|
|
|
8
|
-
task ci: %i[spec
|
|
9
|
-
task default: %i[spec
|
|
7
|
+
task ci: %i[spec standard]
|
|
8
|
+
task default: %i[spec standard:fix]
|
data/exe/kubekrypt
CHANGED
data/kubekrypt.gemspec
CHANGED
|
@@ -1,33 +1,33 @@
|
|
|
1
|
-
lib = File.expand_path(
|
|
1
|
+
lib = File.expand_path("lib", __dir__)
|
|
2
2
|
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
|
3
|
-
require
|
|
3
|
+
require "kubekrypt/version"
|
|
4
4
|
|
|
5
5
|
Gem::Specification.new do |spec|
|
|
6
|
-
spec.name =
|
|
6
|
+
spec.name = "kubekrypt"
|
|
7
7
|
spec.version = KubeKrypt::VERSION
|
|
8
|
-
spec.authors = [
|
|
9
|
-
spec.email = [
|
|
8
|
+
spec.authors = ["Krzysztof Knapik"]
|
|
9
|
+
spec.email = ["knapo@knapo.net"]
|
|
10
10
|
|
|
11
|
-
spec.summary =
|
|
12
|
-
spec.homepage =
|
|
13
|
-
spec.license =
|
|
11
|
+
spec.summary = "KubeKrypt provides seamless encryption and decryption of Kubernetes Secret menifests using Google Cloud KMS"
|
|
12
|
+
spec.homepage = "https://github.com/knapo/kubekrypt"
|
|
13
|
+
spec.license = "MIT"
|
|
14
14
|
|
|
15
|
-
spec.metadata[
|
|
16
|
-
spec.metadata[
|
|
17
|
-
spec.metadata[
|
|
18
|
-
spec.metadata[
|
|
15
|
+
spec.metadata["homepage_uri"] = "https://github.com/knapo/kubekrypt"
|
|
16
|
+
spec.metadata["source_code_uri"] = "https://github.com/knapo/kubekrypt"
|
|
17
|
+
spec.metadata["changelog_uri"] = "https://github.com/knapo/kubekrypt/blob/main/CHANGELOG.md"
|
|
18
|
+
spec.metadata["rubygems_mfa_required"] = "true"
|
|
19
19
|
|
|
20
|
-
spec.required_ruby_version = Gem::Requirement.new(
|
|
20
|
+
spec.required_ruby_version = Gem::Requirement.new(">= 3.4")
|
|
21
21
|
|
|
22
22
|
spec.files = Dir.chdir(__dir__) do
|
|
23
23
|
`git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(bin/|spec/|\.rub)}) }
|
|
24
24
|
end
|
|
25
|
-
spec.bindir =
|
|
25
|
+
spec.bindir = "exe"
|
|
26
26
|
spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
|
|
27
|
-
spec.require_paths = [
|
|
27
|
+
spec.require_paths = ["lib"]
|
|
28
28
|
|
|
29
|
-
spec.add_dependency
|
|
30
|
-
spec.add_dependency
|
|
31
|
-
spec.add_dependency
|
|
32
|
-
spec.add_dependency
|
|
29
|
+
spec.add_dependency "google-cloud-kms"
|
|
30
|
+
spec.add_dependency "grpc", "< 1.74.0" # 1.74.0 & google-cloud-kms produce segmentation fault errors
|
|
31
|
+
spec.add_dependency "thor", ">= 1.0"
|
|
32
|
+
spec.add_dependency "yaml"
|
|
33
33
|
end
|
data/lib/kubekrypt/cli.rb
CHANGED
|
@@ -6,32 +6,32 @@ module KubeKrypt
|
|
|
6
6
|
true
|
|
7
7
|
end
|
|
8
8
|
|
|
9
|
-
desc
|
|
9
|
+
desc "version", "Displays the current version of KubeKrypt"
|
|
10
10
|
def version
|
|
11
11
|
puts KubeKrypt::VERSION
|
|
12
12
|
end
|
|
13
13
|
|
|
14
|
-
method_option KMS_KEY, aliases:
|
|
15
|
-
desc
|
|
14
|
+
method_option KMS_KEY, aliases: "-k", desc: "Google KMS encryption key id to use", required: true
|
|
15
|
+
desc "encrypt FILE", "Encrypts Kubernetes secrets manifest using the specified KMS key"
|
|
16
16
|
def encrypt(file_path)
|
|
17
17
|
yaml_content = File.read(file_path)
|
|
18
18
|
content = YAML.safe_load(yaml_content)
|
|
19
19
|
key_name = options.fetch(KMS_KEY)
|
|
20
20
|
|
|
21
|
-
raise AlreadyEncrytpedError, "#{file_path} is already encrypted" if content[
|
|
21
|
+
raise AlreadyEncrytpedError, "#{file_path} is already encrypted" if content["kubekrypt"]
|
|
22
22
|
|
|
23
23
|
result = KubeKrypt::Encryptor.call(content:, key_name:)
|
|
24
24
|
puts result
|
|
25
25
|
end
|
|
26
26
|
|
|
27
|
-
method_option :base64, desc:
|
|
28
|
-
desc
|
|
27
|
+
method_option :base64, desc: "Base64 encoded values", type: :boolean, required: false
|
|
28
|
+
desc "decrypt FILE", "Decrypts Kubernetes secrets manifest using embedded kubekrypt metadata"
|
|
29
29
|
def decrypt(file_path)
|
|
30
30
|
yaml_content = File.read(file_path)
|
|
31
31
|
content = YAML.safe_load(yaml_content)
|
|
32
32
|
base64 = options.fetch(:base64, false)
|
|
33
33
|
|
|
34
|
-
raise NotEncrytpedError, "#{file_path} is not encrypted" unless content[
|
|
34
|
+
raise NotEncrytpedError, "#{file_path} is not encrypted" unless content["kubekrypt"]
|
|
35
35
|
|
|
36
36
|
result = KubeKrypt::Decryptor.call(content:, base64:)
|
|
37
37
|
puts result
|
data/lib/kubekrypt/decryptor.rb
CHANGED
|
@@ -8,7 +8,7 @@ module KubeKrypt
|
|
|
8
8
|
end
|
|
9
9
|
|
|
10
10
|
def call(encodedtext, base64: false)
|
|
11
|
-
ciphertext = Base64.strict_decode64(encodedtext.sub("#{ENC_PREFIX}:",
|
|
11
|
+
ciphertext = Base64.strict_decode64(encodedtext.sub("#{ENC_PREFIX}:", ""))
|
|
12
12
|
|
|
13
13
|
result = client.decrypt(name: key_name, ciphertext:).plaintext
|
|
14
14
|
|
|
@@ -20,11 +20,11 @@ module KubeKrypt
|
|
|
20
20
|
end
|
|
21
21
|
|
|
22
22
|
def self.call(content:, base64:)
|
|
23
|
-
return content unless content[
|
|
23
|
+
return content unless content["data"]
|
|
24
24
|
|
|
25
25
|
key_name = content.fetch(METADATA_KEY).fetch(KMS_KEY.to_s)
|
|
26
26
|
decryptor = new(key_name)
|
|
27
|
-
content[
|
|
27
|
+
content["data"].transform_values! { |encodedtext| decryptor.call(encodedtext, base64:) }
|
|
28
28
|
content.delete(METADATA_KEY)
|
|
29
29
|
content.to_yaml
|
|
30
30
|
end
|
data/lib/kubekrypt/encryptor.rb
CHANGED
|
@@ -14,16 +14,16 @@ module KubeKrypt
|
|
|
14
14
|
end
|
|
15
15
|
|
|
16
16
|
def self.call(content:, key_name:)
|
|
17
|
-
return content unless content[
|
|
17
|
+
return content unless content["data"]
|
|
18
18
|
|
|
19
19
|
encryptor = new(key_name)
|
|
20
20
|
|
|
21
|
-
content[
|
|
21
|
+
content["data"].transform_values! { |plaintext| encryptor.call(plaintext) }
|
|
22
22
|
|
|
23
23
|
content[METADATA_KEY] = {
|
|
24
24
|
KMS_KEY.to_s => key_name,
|
|
25
|
-
|
|
26
|
-
|
|
25
|
+
"version" => VERSION,
|
|
26
|
+
"modified_at" => Time.now.utc.iso8601
|
|
27
27
|
}
|
|
28
28
|
|
|
29
29
|
content.to_yaml
|
data/lib/kubekrypt/version.rb
CHANGED
data/lib/kubekrypt.rb
CHANGED
|
@@ -1,19 +1,19 @@
|
|
|
1
|
-
require
|
|
2
|
-
require
|
|
3
|
-
require
|
|
4
|
-
require
|
|
5
|
-
require
|
|
1
|
+
require "base64"
|
|
2
|
+
require "google/cloud/kms"
|
|
3
|
+
require "optparse"
|
|
4
|
+
require "thor"
|
|
5
|
+
require "yaml"
|
|
6
6
|
|
|
7
7
|
module KubeKrypt
|
|
8
8
|
AlreadyEncrytpedError = Class.new(StandardError)
|
|
9
9
|
NotEncrytpedError = Class.new(StandardError)
|
|
10
10
|
KMS_KEY = :kms_key
|
|
11
|
-
ENCRYPTION_METHOD =
|
|
12
|
-
METADATA_KEY =
|
|
13
|
-
ENC_PREFIX =
|
|
11
|
+
ENCRYPTION_METHOD = "aes-256-gcm".freeze
|
|
12
|
+
METADATA_KEY = "kubekrypt".freeze
|
|
13
|
+
ENC_PREFIX = "enc".freeze
|
|
14
14
|
end
|
|
15
15
|
|
|
16
|
-
require
|
|
17
|
-
require
|
|
18
|
-
require
|
|
19
|
-
require
|
|
16
|
+
require "kubekrypt/version"
|
|
17
|
+
require "kubekrypt/cli"
|
|
18
|
+
require "kubekrypt/encryptor"
|
|
19
|
+
require "kubekrypt/decryptor"
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: kubekrypt
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 2.0
|
|
4
|
+
version: 2.1.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Krzysztof Knapik
|
|
@@ -103,14 +103,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
103
103
|
requirements:
|
|
104
104
|
- - ">="
|
|
105
105
|
- !ruby/object:Gem::Version
|
|
106
|
-
version: 3.4
|
|
106
|
+
version: '3.4'
|
|
107
107
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
108
108
|
requirements:
|
|
109
109
|
- - ">="
|
|
110
110
|
- !ruby/object:Gem::Version
|
|
111
111
|
version: '0'
|
|
112
112
|
requirements: []
|
|
113
|
-
rubygems_version:
|
|
113
|
+
rubygems_version: 4.0.8
|
|
114
114
|
specification_version: 4
|
|
115
115
|
summary: KubeKrypt provides seamless encryption and decryption of Kubernetes Secret
|
|
116
116
|
menifests using Google Cloud KMS
|