kubesealr 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 35b04586dd5c804bf697478a11e919da402c87519cdb22bc940c9060b0b07792
-  data.tar.gz: cfba159bc9ce48fbe5add4a7640bfb3edfa1f66a79617855e22784e5fa60aaf9
+  metadata.gz: e7a7de36bca5843043b35eed90dc582ba6717e12c50870ff2ce03f628680acb7
+  data.tar.gz: '01896547d9b98c3cb7e5e0836e21626d4a83406a2462ef4b0ebb5abe766d20ce'
 SHA512:
-  metadata.gz: 5b199eef47106927b95b724393e1d4bd9bf003bdad5c13b3251b58e600c3afcac53d9824d2c2e922ef8dc1b0ac848acbd7404f8600a7b5f5769b65c49802a9bf
-  data.tar.gz: 41a52d3229fda407fa074cffae4b8b1af562182142d54c664bce35ae52493f5693d6343d638644bbb729b3f36fd931dbd89c4cdfbae4eed8c1c7a98107034ad9
+  metadata.gz: 76cfd1be8a58295d74510419a624c5668fe385d8535be7a068c59436256b5c8ffe6ffd5ae11b62b21bda0b394125d20e508d8f0bf67bd3b480164fc504fcb7e6
+  data.tar.gz: d0c7f6ea29a85f176026d6aa590b4a1ebdcd296d953be3e4ec1299436835646434e073d332a86ad07cf6e670ec5ed56e8f165a5cf6edd433a706b418a5696166

data/Gemfile.lock

@@ -23,7 +23,7 @@ GIT
 PATH
   remote: .
   specs:
-    kubesealr (0.1.0)
+    kubesealr (0.1.1)
       k8s-ruby
       openssl-oaep
 
@@ -92,4 +92,4 @@ DEPENDENCIES
   rspec (~> 3.0)
 
 BUNDLED WITH
-   2.2.5
+   2.2.6

data/lib/kubeseal.rb

@@ -10,11 +10,12 @@ require 'kubeseal/version'
 
 class Kubeseal
   DEFAULT_KEY_FETCHER = lambda do |_|
-    raise NotImplementedError, "no cert getter passed"
+    raise NotImplementedError, "no cluster key-fetcher passed"
   end
 
-  def initialize(&cluster_sealer_key_fetcher)
-    @cluster_sealer_key_fetcher = cluster_sealer_key_fetcher || DEFAULT_KEY_FETCHER
+  def initialize(key_fetcher: nil, resealer: nil)
+    @cluster_sealer_key_fetcher = key_fetcher || DEFAULT_KEY_FETCHER
+    @cluster_sealer_resealer = resealer
   end
 
   def cluster_sealer_public_key
@@ -94,7 +95,6 @@ class Kubeseal
     )
   end
 
-  private
   def seal(plaintext, scope_label)
     cs_pubkey = self.cluster_sealer_public_key
 
@@ -126,7 +126,6 @@ class Kubeseal
     ciphertext_parts.pack('S>A*A*')
   end
 
-  private
   def unseal(ciphertext, scope_label)
     cs_privkeys_to_try = self.cluster_sealer_private_keys.dup
 
@@ -168,6 +167,47 @@ class Kubeseal
     plaintext
   end
 
+  def reseal(...)
+    if @cluster_sealer_resealer
+      reseal_serverside(...)
+    else
+      reseal_clientside(...)
+    end
+  end
+
+  def reseal_clientside(ciphertext, scope_label)
+    plaintext = unseal(ciphertext, scope_label)
+    seal(plaintext, scope_label)
+  end
+
+  def reseal_serverside(ciphertext, scope_label)
+    rc_namespace, rc_name, scope =
+      case scope_label.split('/', 2)
+      in []
+        ["dummy", "dummy", :"cluster-wide"]
+      in [ns]
+        [ns, "dummy", :"namespace-wide"]
+      in [ns, name]
+        [ns, name, :strict]
+      end
+
+    rc = build_sealed_secret_rc(
+      rc_namespace,
+      rc_name,
+      'Opaque',
+      armor({'dummy' => ciphertext}, strict: true)
+    )
+    rc = patch_with_scope(rc, scope)
+
+    resealed_rc = reseal_wrapped_serverside(rc)
+
+    Base64.decode64(resealed_rc.dig('spec', 'encryptedData', 'dummy'))
+  end
+
+  def reseal_wrapped_serverside(sealed_secret_rc)
+    YAML.load(@cluster_sealer_resealer.call(sealed_secret_rc.to_yaml))
+  end
+
   private
   def label_for(scope, rc_namespace, rc_name)
     case scope
@@ -248,8 +288,12 @@ class Kubeseal
     end
   end
 
-  def armor(h)
-    (h || {}).map{ |k, v| [k, Base64.encode64(v)] }.to_h
+  def armor(h, strict: false)
+    if strict
+      (h || {}).map{ |k, v| [k, Base64.strict_encode64(v)] }.to_h
+    else
+      (h || {}).map{ |k, v| [k, Base64.encode64(v)] }.to_h
+    end
   end
 
   def unarmor(h)

data/lib/kubeseal/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class Kubeseal
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kubesealr
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Levi Aul
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2021-01-20 00:00:00.000000000 Z
+date: 2021-01-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: k8s-ruby