@codemowers/oidc-key-manager 0.2.2 → 1.1.0

package/README.md

@@ -1,27 +1,27 @@
-oidc-key-manager
-=================
-
-CLI to manage secret keys required by oidc-gateway
-
+oidc-key-manager
+=================
+
+CLI to manage secret keys required by oidc-gateway
+
 <!-- toc -->
 * [Usage](#usage)
 * [Commands](#commands)
-<!-- tocstop -->
-# Usage
+<!-- tocstop -->
+# Usage
 <!-- usage -->
 ```sh-session
 $ npm install -g @codemowers/oidc-key-manager
 $ key-manager COMMAND
 running command...
 $ key-manager (--version)
-@codemowers/oidc-key-manager/0.2.2 linux-x64 node-v16.17.0
+@codemowers/oidc-key-manager/1.1.0 linux-x64 node-v22.17.1
 $ key-manager --help [COMMAND]
 USAGE
   $ key-manager COMMAND
 ...
 ```
-<!-- usagestop -->
-# Commands
+<!-- usagestop -->
+# Commands
 <!-- commands -->
 * [`key-manager initialize`](#key-manager-initialize)
 * [`key-manager rotate`](#key-manager-rotate)
@@ -32,14 +32,15 @@ Initialize the secret with initial keys
 
 ```
 USAGE
-  $ key-manager initialize -c local|cluster [--json] [-n <value>] [-s <value>] [--recreate]
+  $ key-manager initialize -c local|cluster [--json] [-n <value>] [-s <value>] [-l <value>] [--recreate]
 
 FLAGS
-  -c, --config=<option>    (required) use local or in-cluster Kubernetes config
-                           <options: local|cluster>
-  -n, --namespace=<value>  namespace, defaults to current namespace if service account is used
-  -s, --secret=<value>     [default: oidc-keys] secret name
-  --recreate               recreate the secret if it exists
+  -c, --config=<option>             (required) use local or in-cluster Kubernetes config
+                                    <options: local|cluster>
+  -l, --additionalLabel=<value>...  Add custom Kubernetes label (may be repeated)
+  -n, --namespace=<value>           namespace, defaults to current namespace if service account is used
+  -s, --secret=<value>              [default: oidc-keys] secret name
+      --recreate                    recreate the secret if it exists
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -55,9 +56,11 @@ EXAMPLES
   $ key-manager initialize -n <kube namespace> -s <secret name>
 
   $ key-manager initialize --namespace <kube namespace> --secret <secret name> --recreate
+
+  $ key-manager initialize --additional-label "app.kubernetes.io/instance: passmower"
 ```
 
-_See code: [dist/commands/initialize.ts](https://github.com/codemowers/oidc-key-manager/blob/v0.2.2/dist/commands/initialize.ts)_
+_See code: [src/commands/initialize.ts](https://github.com/codemowers/oidc-key-manager/blob/v1.1.0/src/commands/initialize.ts)_
 
 ## `key-manager rotate`
 
@@ -65,22 +68,23 @@ Append new JWK|cookie key|both and rotate the array, optionally restarting the d
 
 ```
 USAGE
-  $ key-manager rotate -c local|cluster [-n <value>] [-s <value>] [--both] [--jwks] [--cookie-keys]
-    [--max-number-of-jwks <value>] [--max-number-of-cookie-keys <value>] [--restart-deployment-backoff <value>
-    --restart-deployment <value>]
+  $ key-manager rotate -c local|cluster [-n <value>] [-s <value>] [-l <value>] [--both] [--jwks]
+    [--cookie-keys] [--max-number-of-jwks <value>] [--max-number-of-cookie-keys <value>] [--restart-deployment-backoff
+    <value> --restart-deployment <value>]
 
 FLAGS
-  -c, --config=<option>                 (required) use local or in-cluster Kubernetes config
-                                        <options: local|cluster>
-  -n, --namespace=<value>               namespace, defaults to current namespace if service account is used
-  -s, --secret=<value>                  [default: oidc-keys] secret name
-  --both                                rotate both JWKs and cookie keys
-  --cookie-keys                         rotate cookie keys
-  --jwks                                rotate JWKs
-  --max-number-of-cookie-keys=<value>   [default: 3]
-  --max-number-of-jwks=<value>          [default: 3]
-  --restart-deployment=<value>          Kubernetes deployment name to restart while rotating
-  --restart-deployment-backoff=<value>  [default: 60] Seconds to wait for deployment to restart
+  -c, --config=<option>                     (required) use local or in-cluster Kubernetes config
+                                            <options: local|cluster>
+  -l, --additionalLabel=<value>...          Add custom Kubernetes label (may be repeated)
+  -n, --namespace=<value>                   namespace, defaults to current namespace if service account is used
+  -s, --secret=<value>                      [default: oidc-keys] secret name
+      --both                                rotate both JWKs and cookie keys
+      --cookie-keys                         rotate cookie keys
+      --jwks                                rotate JWKs
+      --max-number-of-cookie-keys=<value>   [default: 3]
+      --max-number-of-jwks=<value>          [default: 3]
+      --restart-deployment=<value>          Kubernetes deployment name to restart while rotating
+      --restart-deployment-backoff=<value>  [default: 60] Seconds to wait for deployment to restart
 
 DESCRIPTION
   Append new JWK|cookie key|both and rotate the array, optionally restarting the deployment
@@ -89,5 +93,5 @@ EXAMPLES
   $ key-manager rotate
 ```
 
-_See code: [dist/commands/rotate.ts](https://github.com/codemowers/oidc-key-manager/blob/v0.2.2/dist/commands/rotate.ts)_
+_See code: [src/commands/rotate.ts](https://github.com/codemowers/oidc-key-manager/blob/v1.1.0/src/commands/rotate.ts)_
 <!-- commandsstop -->

package/bin/dev.cmd

@@ -1,3 +1,3 @@
-@echo off
-
+@echo off
+
 node "%~dp0\dev" %*

package/bin/run.cmd

@@ -1,3 +1,3 @@
-@echo off
-
-node "%~dp0\run" %*
+@echo off
+
+node "%~dp0\run" %*

package/dist/commands/initialize.d.ts

@@ -5,9 +5,10 @@ export default class Initialize extends Command {
     static examples: string[];
     static flags: {
         recreate: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
-        namespace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
-        secret: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
-        config: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        namespace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        secret: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        config: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        additionalLabel: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     static args: {};
     run(): Promise<void>;

package/dist/commands/initialize.js

@@ -12,7 +12,7 @@ class Initialize extends core_1.Command {
         kubeApiService.printConfiguration();
         const exists = await kubeApiService.getSecret();
         if (exists && !flags.recreate) {
-            this.exit(0);
+            return;
         }
         if (exists) {
             await kubeApiService.deleteSecret();
@@ -20,10 +20,9 @@ class Initialize extends core_1.Command {
         const secret = new secret_1.Secret(this);
         this.log('Generating secret');
         secret.generateNew();
-        await kubeApiService.createSecret(secret);
+        await kubeApiService.createSecret(secret, flags.additionalLabel);
     }
 }
-exports.default = Initialize;
 Initialize.description = 'Initialize the secret with initial keys';
 Initialize.enableJsonFlag = true;
 Initialize.examples = [
@@ -31,9 +30,11 @@ Initialize.examples = [
     '<%= config.bin %> <%= command.id %>',
     '<%= config.bin %> <%= command.id %> -n <kube namespace> -s <secret name>',
     '<%= config.bin %> <%= command.id %> --namespace <kube namespace> --secret <secret name> --recreate',
+    '<%= config.bin %> <%= command.id %> --additional-label "app.kubernetes.io/instance: passmower"',
 ];
 Initialize.flags = {
     ...common_flags_1.default,
     recreate: core_1.Flags.boolean({ description: 'recreate the secret if it exists', aliases: ['recreate'], required: false }),
 };
 Initialize.args = {};
+exports.default = Initialize;

package/dist/commands/rotate.d.ts

@@ -6,13 +6,14 @@ export default class Rotate extends Command {
         both: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         jwks: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'cookie-keys': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
-        'max-number-of-jwks': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
-        'max-number-of-cookie-keys': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
-        'restart-deployment': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
-        'restart-deployment-backoff': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
-        namespace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
-        secret: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
-        config: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        'max-number-of-jwks': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'max-number-of-cookie-keys': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'restart-deployment': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'restart-deployment-backoff': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        namespace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        secret: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        config: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        additionalLabel: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     static args: {};
     run(): Promise<void>;

package/dist/commands/rotate.js

@@ -13,7 +13,6 @@ class Rotate extends core_1.Command {
         const kubeSecret = await kubeApiService.getSecret();
         if (!kubeSecret) {
             this.error('Secret does not exist');
-            this.exit(1);
         }
         const secret = new secret_1.Secret(this);
         secret.fromKubeSecret(kubeSecret);
@@ -23,7 +22,7 @@ class Rotate extends core_1.Command {
         if (flags.both || flags['cookie-keys']) {
             secret.appendCookieKey(flags['max-number-of-cookie-keys']);
         }
-        await kubeApiService.replaceSecret(secret);
+        await kubeApiService.replaceSecret(secret, flags.additionalLabel);
         let restarted = false;
         if (flags['restart-deployment']) {
             try {
@@ -41,7 +40,7 @@ class Rotate extends core_1.Command {
         if (flags.both || flags.jwks) {
             secret.rotateCookieKeys();
         }
-        await kubeApiService.replaceSecret(secret);
+        await kubeApiService.replaceSecret(secret, flags.additionalLabel);
         if (flags['restart-deployment']) {
             try {
                 await kubeApiService.restartDeployment(flags['restart-deployment'], flags['restart-deployment-backoff']);
@@ -55,7 +54,6 @@ class Rotate extends core_1.Command {
         this.log('Keys rotated' + (restarted ? '' : ', but deployment not restarted'));
     }
 }
-exports.default = Rotate;
 Rotate.description = 'Append new JWK|cookie key|both and rotate the array, optionally restarting the deployment';
 Rotate.examples = [
     '<%= config.bin %> <%= command.id %>',
@@ -71,3 +69,4 @@ Rotate.flags = {
     'restart-deployment-backoff': core_1.Flags.integer({ description: 'Seconds to wait for deployment to restart', default: 60, dependsOn: ['restart-deployment'] }),
 };
 Rotate.args = {};
+exports.default = Rotate;

package/dist/helpers/common-flags.d.ts

@@ -8,8 +8,9 @@ export declare enum ConfigType {
     InCluster = "cluster"
 }
 declare const _default: {
-    namespace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
-    secret: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
-    config: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+    namespace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    secret: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    config: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    additionalLabel: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
 };
 export default _default;

package/dist/helpers/common-flags.js

@@ -6,9 +6,10 @@ var ConfigType;
 (function (ConfigType) {
     ConfigType["Local"] = "local";
     ConfigType["InCluster"] = "cluster";
-})(ConfigType = exports.ConfigType || (exports.ConfigType = {}));
+})(ConfigType || (exports.ConfigType = ConfigType = {}));
 exports.default = {
     namespace: core_1.Flags.string({ char: 'n', description: 'namespace, defaults to current namespace if service account is used', aliases: ['namespace'], required: false }),
     secret: core_1.Flags.string({ char: 's', description: 'secret name', aliases: ['secret'], default: 'oidc-keys', required: false }),
     config: core_1.Flags.string({ char: 'c', description: 'use local or in-cluster Kubernetes config', aliases: ['config'], required: true, options: [ConfigType.Local, ConfigType.InCluster] }),
+    additionalLabel: core_1.Flags.string({ char: 'l', description: 'Add custom Kubernetes label (may be repeated)', aliases: ['additional-label'], required: false, multiple: true }),
 };

package/dist/helpers/kube-api-service.d.ts

@@ -15,6 +15,6 @@ export declare class KubeApiService {
     restartDeployment(deploymentName: string, timeoutInSeconds: number): Promise<any>;
     getSecret(): Promise<V1Secret | undefined | null>;
     deleteSecret(): Promise<void>;
-    createSecret(secret: Secret): Promise<void>;
-    replaceSecret(secret: Secret): Promise<void>;
+    createSecret(secret: Secret, labels?: any): Promise<void>;
+    replaceSecret(secret: Secret, labels?: any): Promise<void>;
 }

package/dist/helpers/kube-api-service.js

@@ -72,7 +72,6 @@ class KubeApiService {
             .catch(error => {
             if (error.statusCode !== 404) {
                 this.command.error(error);
-                this.command.exit(1);
             }
             return null;
         });
@@ -84,14 +83,14 @@ class KubeApiService {
         await this.coreV1Api.deleteNamespacedSecret(this.secretName, this.namespace).then(() => true);
         this.command.log(`Existing secret ${this.secretName} deleted`);
     }
-    async createSecret(secret) {
+    async createSecret(secret, labels) {
         this.command.log(`Creating secret ${this.secretName}`);
-        await this.coreV1Api.createNamespacedSecret(this.namespace, secret.toKubeSecret(this.secretName));
+        await this.coreV1Api.createNamespacedSecret(this.namespace, secret.toKubeSecret(this.secretName, labels));
         this.command.log(`Created secret ${this.secretName}`);
     }
-    async replaceSecret(secret) {
+    async replaceSecret(secret, labels) {
         this.command.log(`Replacing secret ${this.secretName}`);
-        await this.coreV1Api.replaceNamespacedSecret(this.secretName, this.namespace, secret.toKubeSecret(this.secretName));
+        await this.coreV1Api.replaceNamespacedSecret(this.secretName, this.namespace, secret.toKubeSecret(this.secretName, labels));
     }
 }
 exports.KubeApiService = KubeApiService;

package/dist/helpers/secret.d.ts

@@ -7,7 +7,7 @@ export declare class Secret {
     private command;
     constructor(command: Command);
     generateNew(): void;
-    toKubeSecret(secretName: string): V1Secret;
+    toKubeSecret(secretName: string, labels?: any): V1Secret;
     fromKubeSecret(kubeSecret: V1Secret): void;
     appendJWK(maxNumber: number): void;
     appendCookieKey(maxNumber: number): void;

package/dist/helpers/secret.js

@@ -19,9 +19,9 @@ class Secret {
         this.JWKs = [tslib_1.__classPrivateFieldGet(this, _Secret_instances, "m", _Secret_generateRSAJwk).call(this, 4096)];
         this.CookieKeys = [tslib_1.__classPrivateFieldGet(this, _Secret_instances, "m", _Secret_generateCookieKey).call(this, 32)];
     }
-    toKubeSecret(secretName) {
+    toKubeSecret(secretName, labels) {
         const secret = new client_node_1.V1Secret();
-        secret.metadata = tslib_1.__classPrivateFieldGet(this, _Secret_instances, "m", _Secret_getKubeSecretMetadata).call(this, secretName);
+        secret.metadata = tslib_1.__classPrivateFieldGet(this, _Secret_instances, "m", _Secret_getKubeSecretMetadata).call(this, secretName, labels);
         secret.data = {};
         secret.data[JWKSKeyName] = tslib_1.__classPrivateFieldGet(this, _Secret_instances, "m", _Secret_arrayToB64String).call(this, this.JWKs);
         secret.data[CookieKeysKeyName] = tslib_1.__classPrivateFieldGet(this, _Secret_instances, "m", _Secret_arrayToB64String).call(this, this.CookieKeys);
@@ -73,8 +73,11 @@ _Secret_instances = new WeakSet(), _Secret_append = function _Secret_append(prop
 }, _Secret_arrayToB64String = function _Secret_arrayToB64String(array) {
     const b = Buffer.from(JSON.stringify(array));
     return b.toString('base64');
-}, _Secret_getKubeSecretMetadata = function _Secret_getKubeSecretMetadata(secretName) {
+}, _Secret_getKubeSecretMetadata = function _Secret_getKubeSecretMetadata(secretName, labels) {
     const metaData = new client_node_1.V1ObjectMeta();
     metaData.name = secretName;
+    if (labels) {
+        metaData.labels = labels;
+    }
     return metaData;
 };

package/oclif.manifest.json

@@ -1,177 +1,230 @@
 {
-  "version": "0.2.2",
   "commands": {
     "initialize": {
-      "id": "initialize",
-      "description": "Initialize the secret with initial keys",
-      "strict": true,
-      "pluginName": "@codemowers/oidc-key-manager",
-      "pluginAlias": "@codemowers/oidc-key-manager",
-      "pluginType": "core",
       "aliases": [],
+      "args": {},
+      "description": "Initialize the secret with initial keys",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %> -n <kube namespace> -s <secret name>",
-        "<%= config.bin %> <%= command.id %> --namespace <kube namespace> --secret <secret name> --recreate"
+        "<%= config.bin %> <%= command.id %> --namespace <kube namespace> --secret <secret name> --recreate",
+        "<%= config.bin %> <%= command.id %> --additional-label \"app.kubernetes.io/instance: passmower\""
       ],
       "flags": {
         "json": {
-          "name": "json",
-          "type": "boolean",
           "description": "Format output as json.",
           "helpGroup": "GLOBAL",
-          "allowNo": false
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
         },
         "namespace": {
-          "name": "namespace",
-          "type": "option",
+          "aliases": [
+            "namespace"
+          ],
           "char": "n",
           "description": "namespace, defaults to current namespace if service account is used",
+          "name": "namespace",
           "required": false,
+          "hasDynamicHelp": false,
           "multiple": false,
-          "aliases": [
-            "namespace"
-          ]
+          "type": "option"
         },
         "secret": {
-          "name": "secret",
-          "type": "option",
+          "aliases": [
+            "secret"
+          ],
           "char": "s",
           "description": "secret name",
+          "name": "secret",
           "required": false,
-          "multiple": false,
           "default": "oidc-keys",
-          "aliases": [
-            "secret"
-          ]
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         },
         "config": {
-          "name": "config",
-          "type": "option",
+          "aliases": [
+            "config"
+          ],
           "char": "c",
           "description": "use local or in-cluster Kubernetes config",
+          "name": "config",
           "required": true,
+          "hasDynamicHelp": false,
           "multiple": false,
           "options": [
             "local",
             "cluster"
           ],
+          "type": "option"
+        },
+        "additionalLabel": {
           "aliases": [
-            "config"
-          ]
+            "additional-label"
+          ],
+          "char": "l",
+          "description": "Add custom Kubernetes label (may be repeated)",
+          "name": "additionalLabel",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         },
         "recreate": {
-          "name": "recreate",
-          "type": "boolean",
+          "aliases": [
+            "recreate"
+          ],
           "description": "recreate the secret if it exists",
+          "name": "recreate",
           "required": false,
           "allowNo": false,
-          "aliases": [
-            "recreate"
-          ]
+          "type": "boolean"
         }
       },
-      "args": {}
-    },
-    "rotate": {
-      "id": "rotate",
-      "description": "Append new JWK|cookie key|both and rotate the array, optionally restarting the deployment",
-      "strict": true,
-      "pluginName": "@codemowers/oidc-key-manager",
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "initialize",
       "pluginAlias": "@codemowers/oidc-key-manager",
+      "pluginName": "@codemowers/oidc-key-manager",
       "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "initialize.js"
+      ]
+    },
+    "rotate": {
       "aliases": [],
+      "args": {},
+      "description": "Append new JWK|cookie key|both and rotate the array, optionally restarting the deployment",
       "examples": [
         "<%= config.bin %> <%= command.id %>"
       ],
       "flags": {
         "namespace": {
-          "name": "namespace",
-          "type": "option",
+          "aliases": [
+            "namespace"
+          ],
           "char": "n",
           "description": "namespace, defaults to current namespace if service account is used",
+          "name": "namespace",
           "required": false,
+          "hasDynamicHelp": false,
           "multiple": false,
-          "aliases": [
-            "namespace"
-          ]
+          "type": "option"
         },
         "secret": {
-          "name": "secret",
-          "type": "option",
+          "aliases": [
+            "secret"
+          ],
           "char": "s",
           "description": "secret name",
+          "name": "secret",
           "required": false,
-          "multiple": false,
           "default": "oidc-keys",
-          "aliases": [
-            "secret"
-          ]
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         },
         "config": {
-          "name": "config",
-          "type": "option",
+          "aliases": [
+            "config"
+          ],
           "char": "c",
           "description": "use local or in-cluster Kubernetes config",
+          "name": "config",
           "required": true,
+          "hasDynamicHelp": false,
           "multiple": false,
           "options": [
             "local",
             "cluster"
           ],
+          "type": "option"
+        },
+        "additionalLabel": {
           "aliases": [
-            "config"
-          ]
+            "additional-label"
+          ],
+          "char": "l",
+          "description": "Add custom Kubernetes label (may be repeated)",
+          "name": "additionalLabel",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         },
         "both": {
-          "name": "both",
-          "type": "boolean",
           "description": "rotate both JWKs and cookie keys",
-          "allowNo": false
+          "name": "both",
+          "allowNo": false,
+          "type": "boolean"
         },
         "jwks": {
-          "name": "jwks",
-          "type": "boolean",
           "description": "rotate JWKs",
-          "allowNo": false
+          "name": "jwks",
+          "allowNo": false,
+          "type": "boolean"
         },
         "cookie-keys": {
-          "name": "cookie-keys",
-          "type": "boolean",
           "description": "rotate cookie keys",
-          "allowNo": false
+          "name": "cookie-keys",
+          "allowNo": false,
+          "type": "boolean"
         },
         "max-number-of-jwks": {
           "name": "max-number-of-jwks",
-          "type": "option",
+          "default": 3,
+          "hasDynamicHelp": false,
           "multiple": false,
-          "default": 3
+          "type": "option"
         },
         "max-number-of-cookie-keys": {
           "name": "max-number-of-cookie-keys",
-          "type": "option",
+          "default": 3,
+          "hasDynamicHelp": false,
           "multiple": false,
-          "default": 3
+          "type": "option"
         },
         "restart-deployment": {
-          "name": "restart-deployment",
-          "type": "option",
           "description": "Kubernetes deployment name to restart while rotating",
-          "multiple": false
+          "name": "restart-deployment",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         },
         "restart-deployment-backoff": {
-          "name": "restart-deployment-backoff",
-          "type": "option",
-          "description": "Seconds to wait for deployment to restart",
-          "multiple": false,
           "dependsOn": [
             "restart-deployment"
           ],
-          "default": 60
+          "description": "Seconds to wait for deployment to restart",
+          "name": "restart-deployment-backoff",
+          "default": 60,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
-      "args": {}
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "rotate",
+      "pluginAlias": "@codemowers/oidc-key-manager",
+      "pluginName": "@codemowers/oidc-key-manager",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "rotate.js"
+      ]
     }
-  }
+  },
+  "version": "1.1.0"
 }

package/package.json

@@ -1,68 +1,68 @@
-{
-  "name": "@codemowers/oidc-key-manager",
-  "version": "0.2.2",
-  "description": "CLI to manage secret keys required by oidc-gateway",
-  "author": "Erki Aas",
-  "bin": {
-    "key-manager": "./bin/run"
-  },
-  "homepage": "https://github.com/codemowers/oidc-key-manager",
-  "license": "MIT",
-  "main": "dist/index.js",
-  "repository": "codemowers/oidc-key-manager",
-  "files": [
-    "/bin",
-    "/dist",
-    "/npm-shrinkwrap.json",
-    "/oclif.manifest.json"
-  ],
-  "dependencies": {
-    "@kubernetes/client-node": "^0.18.1",
-    "@oclif/core": "^2.8.4",
-    "@oclif/plugin-help": "^5",
-    "@oclif/plugin-plugins": "^2.4.7",
-    "@types/jsrsasign": "^10.5.8",
-    "jsrsasign": "^10.8.6"
-  },
-  "devDependencies": {
-    "@oclif/test": "^2.3.17",
-    "@types/chai": "^4",
-    "@types/mocha": "^9.0.0",
-    "@types/node": "^16.18.25",
-    "chai": "^4",
-    "eslint": "^7.32.0",
-    "eslint-config-oclif": "^4",
-    "eslint-config-oclif-typescript": "^1.0.3",
-    "mocha": "^9",
-    "oclif": "^3",
-    "shx": "^0.3.4",
-    "ts-node": "^10.9.1",
-    "tslib": "^2.5.0",
-    "typescript": "^4.9.5"
-  },
-  "oclif": {
-    "bin": "key-manager",
-    "dirname": "key-manager",
-    "commands": "./dist/commands",
-    "topicSeparator": " ",
-    "topics": {
-      "hello": {
-        "description": "Say hello to the world and others"
-      }
-    }
-  },
-  "scripts": {
-    "build": "shx rm -rf dist && tsc -b",
-    "lint": "eslint . --ext .ts --config .eslintrc",
-    "postpack": "shx rm -f oclif.manifest.json",
-    "posttest": "npm run lint",
-    "prepack": "npm run build && oclif manifest && oclif readme",
-    "test": "mocha --forbid-only \"test/**/*.test.ts\"",
-    "version": "oclif readme && git add README.md"
-  },
-  "engines": {
-    "node": ">=12.0.0"
-  },
-  "bugs": "https://github.com/codemowers/oidc-key-manager/issues",
-  "types": "dist/index.d.ts"
-}
+{
+  "name": "@codemowers/oidc-key-manager",
+  "version": "1.1.0",
+  "description": "CLI to manage secret keys required by oidc-gateway",
+  "author": "Erki Aas",
+  "bin": {
+    "key-manager": "./bin/run"
+  },
+  "homepage": "https://github.com/codemowers/oidc-key-manager",
+  "license": "MIT",
+  "main": "dist/index.js",
+  "repository": "codemowers/oidc-key-manager",
+  "files": [
+    "/bin",
+    "/dist",
+    "/npm-shrinkwrap.json",
+    "/oclif.manifest.json"
+  ],
+  "dependencies": {
+    "@kubernetes/client-node": "^0.20.0",
+    "@oclif/core": "^3.26.0",
+    "@oclif/plugin-help": "^6.0.20",
+    "@oclif/plugin-plugins": "^2.4.7",
+    "@types/jsrsasign": "^10.5.13",
+    "jsrsasign": "^11.1.0"
+  },
+  "devDependencies": {
+    "@oclif/test": "^3.2.8",
+    "@types/chai": "^4.3.14",
+    "@types/mocha": "^10.0.6",
+    "@types/node": "^20.12.2",
+    "chai": "^5.1.0",
+    "eslint": "^8.57.0",
+    "eslint-config-oclif": "^5.1.1",
+    "eslint-config-oclif-typescript": "^2.0.1",
+    "mocha": "^10.4.0",
+    "oclif": "^4.7.5",
+    "shx": "^0.3.4",
+    "ts-node": "^10.9.2",
+    "tslib": "^2.6.2",
+    "typescript": "^5.4.3"
+  },
+  "oclif": {
+    "bin": "key-manager",
+    "dirname": "key-manager",
+    "commands": "./dist/commands",
+    "topicSeparator": " ",
+    "topics": {
+      "hello": {
+        "description": "Say hello to the world and others"
+      }
+    }
+  },
+  "scripts": {
+    "build": "shx rm -rf dist && tsc -b",
+    "lint": "eslint . --ext .ts --config .eslintrc",
+    "postpack": "shx rm -f oclif.manifest.json",
+    "posttest": "npm run lint",
+    "prepack": "npm run build && oclif manifest && oclif readme",
+    "test": "mocha --forbid-only \"test/**/*.test.ts\"",
+    "version": "oclif readme && git add README.md"
+  },
+  "engines": {
+    "node": ">=12.0.0"
+  },
+  "bugs": "https://github.com/codemowers/oidc-key-manager/issues",
+  "types": "dist/index.d.ts"
+}