@codemowers/oidc-key-manager 1.0.0 → 1.1.0

package/README.md

@@ -14,7 +14,7 @@ $ npm install -g @codemowers/oidc-key-manager
 $ key-manager COMMAND
 running command...
 $ key-manager (--version)
-@codemowers/oidc-key-manager/1.0.0 linux-x64 node-v20.12.0
+@codemowers/oidc-key-manager/1.1.0 linux-x64 node-v22.17.1
 $ key-manager --help [COMMAND]
 USAGE
   $ key-manager COMMAND
@@ -32,14 +32,15 @@ Initialize the secret with initial keys
 
 ```
 USAGE
-  $ key-manager initialize -c local|cluster [--json] [-n <value>] [-s <value>] [--recreate]
+  $ key-manager initialize -c local|cluster [--json] [-n <value>] [-s <value>] [-l <value>] [--recreate]
 
 FLAGS
-  -c, --config=<option>    (required) use local or in-cluster Kubernetes config
-                           <options: local|cluster>
-  -n, --namespace=<value>  namespace, defaults to current namespace if service account is used
-  -s, --secret=<value>     [default: oidc-keys] secret name
-      --recreate           recreate the secret if it exists
+  -c, --config=<option>             (required) use local or in-cluster Kubernetes config
+                                    <options: local|cluster>
+  -l, --additionalLabel=<value>...  Add custom Kubernetes label (may be repeated)
+  -n, --namespace=<value>           namespace, defaults to current namespace if service account is used
+  -s, --secret=<value>              [default: oidc-keys] secret name
+      --recreate                    recreate the secret if it exists
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -55,9 +56,11 @@ EXAMPLES
   $ key-manager initialize -n <kube namespace> -s <secret name>
 
   $ key-manager initialize --namespace <kube namespace> --secret <secret name> --recreate
+
+  $ key-manager initialize --additional-label "app.kubernetes.io/instance: passmower"
 ```
 
-_See code: [src/commands/initialize.ts](https://github.com/codemowers/oidc-key-manager/blob/v1.0.0/src/commands/initialize.ts)_
+_See code: [src/commands/initialize.ts](https://github.com/codemowers/oidc-key-manager/blob/v1.1.0/src/commands/initialize.ts)_
 
 ## `key-manager rotate`
 
@@ -65,13 +68,14 @@ Append new JWK|cookie key|both and rotate the array, optionally restarting the d
 
 ```
 USAGE
-  $ key-manager rotate -c local|cluster [-n <value>] [-s <value>] [--both] [--jwks] [--cookie-keys]
-    [--max-number-of-jwks <value>] [--max-number-of-cookie-keys <value>] [--restart-deployment-backoff <value>
-    --restart-deployment <value>]
+  $ key-manager rotate -c local|cluster [-n <value>] [-s <value>] [-l <value>] [--both] [--jwks]
+    [--cookie-keys] [--max-number-of-jwks <value>] [--max-number-of-cookie-keys <value>] [--restart-deployment-backoff
+    <value> --restart-deployment <value>]
 
 FLAGS
   -c, --config=<option>                     (required) use local or in-cluster Kubernetes config
                                             <options: local|cluster>
+  -l, --additionalLabel=<value>...          Add custom Kubernetes label (may be repeated)
   -n, --namespace=<value>                   namespace, defaults to current namespace if service account is used
   -s, --secret=<value>                      [default: oidc-keys] secret name
       --both                                rotate both JWKs and cookie keys
@@ -89,5 +93,5 @@ EXAMPLES
   $ key-manager rotate
 ```
 
-_See code: [src/commands/rotate.ts](https://github.com/codemowers/oidc-key-manager/blob/v1.0.0/src/commands/rotate.ts)_
+_See code: [src/commands/rotate.ts](https://github.com/codemowers/oidc-key-manager/blob/v1.1.0/src/commands/rotate.ts)_
 <!-- commandsstop -->

package/dist/commands/initialize.d.ts

@@ -8,6 +8,7 @@ export default class Initialize extends Command {
         namespace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         secret: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         config: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        additionalLabel: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     static args: {};
     run(): Promise<void>;

package/dist/commands/initialize.js

@@ -12,7 +12,7 @@ class Initialize extends core_1.Command {
         kubeApiService.printConfiguration();
         const exists = await kubeApiService.getSecret();
         if (exists && !flags.recreate) {
-            this.exit(0);
+            return;
         }
         if (exists) {
             await kubeApiService.deleteSecret();
@@ -20,7 +20,7 @@ class Initialize extends core_1.Command {
         const secret = new secret_1.Secret(this);
         this.log('Generating secret');
         secret.generateNew();
-        await kubeApiService.createSecret(secret);
+        await kubeApiService.createSecret(secret, flags.additionalLabel);
     }
 }
 Initialize.description = 'Initialize the secret with initial keys';
@@ -30,6 +30,7 @@ Initialize.examples = [
     '<%= config.bin %> <%= command.id %>',
     '<%= config.bin %> <%= command.id %> -n <kube namespace> -s <secret name>',
     '<%= config.bin %> <%= command.id %> --namespace <kube namespace> --secret <secret name> --recreate',
+    '<%= config.bin %> <%= command.id %> --additional-label "app.kubernetes.io/instance: passmower"',
 ];
 Initialize.flags = {
     ...common_flags_1.default,

package/dist/commands/rotate.d.ts

@@ -13,6 +13,7 @@ export default class Rotate extends Command {
         namespace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         secret: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         config: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        additionalLabel: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     static args: {};
     run(): Promise<void>;

package/dist/commands/rotate.js

@@ -13,7 +13,6 @@ class Rotate extends core_1.Command {
         const kubeSecret = await kubeApiService.getSecret();
         if (!kubeSecret) {
             this.error('Secret does not exist');
-            this.exit(1);
         }
         const secret = new secret_1.Secret(this);
         secret.fromKubeSecret(kubeSecret);
@@ -23,7 +22,7 @@ class Rotate extends core_1.Command {
         if (flags.both || flags['cookie-keys']) {
             secret.appendCookieKey(flags['max-number-of-cookie-keys']);
         }
-        await kubeApiService.replaceSecret(secret);
+        await kubeApiService.replaceSecret(secret, flags.additionalLabel);
         let restarted = false;
         if (flags['restart-deployment']) {
             try {
@@ -41,7 +40,7 @@ class Rotate extends core_1.Command {
         if (flags.both || flags.jwks) {
             secret.rotateCookieKeys();
         }
-        await kubeApiService.replaceSecret(secret);
+        await kubeApiService.replaceSecret(secret, flags.additionalLabel);
         if (flags['restart-deployment']) {
             try {
                 await kubeApiService.restartDeployment(flags['restart-deployment'], flags['restart-deployment-backoff']);

package/dist/helpers/common-flags.d.ts

@@ -11,5 +11,6 @@ declare const _default: {
     namespace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     secret: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
     config: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    additionalLabel: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
 };
 export default _default;

package/dist/helpers/common-flags.js

@@ -11,4 +11,5 @@ exports.default = {
     namespace: core_1.Flags.string({ char: 'n', description: 'namespace, defaults to current namespace if service account is used', aliases: ['namespace'], required: false }),
     secret: core_1.Flags.string({ char: 's', description: 'secret name', aliases: ['secret'], default: 'oidc-keys', required: false }),
     config: core_1.Flags.string({ char: 'c', description: 'use local or in-cluster Kubernetes config', aliases: ['config'], required: true, options: [ConfigType.Local, ConfigType.InCluster] }),
+    additionalLabel: core_1.Flags.string({ char: 'l', description: 'Add custom Kubernetes label (may be repeated)', aliases: ['additional-label'], required: false, multiple: true }),
 };

package/dist/helpers/kube-api-service.d.ts

@@ -15,6 +15,6 @@ export declare class KubeApiService {
     restartDeployment(deploymentName: string, timeoutInSeconds: number): Promise<any>;
     getSecret(): Promise<V1Secret | undefined | null>;
     deleteSecret(): Promise<void>;
-    createSecret(secret: Secret): Promise<void>;
-    replaceSecret(secret: Secret): Promise<void>;
+    createSecret(secret: Secret, labels?: any): Promise<void>;
+    replaceSecret(secret: Secret, labels?: any): Promise<void>;
 }

package/dist/helpers/kube-api-service.js

@@ -72,7 +72,6 @@ class KubeApiService {
             .catch(error => {
             if (error.statusCode !== 404) {
                 this.command.error(error);
-                this.command.exit(1);
             }
             return null;
         });
@@ -84,14 +83,14 @@ class KubeApiService {
         await this.coreV1Api.deleteNamespacedSecret(this.secretName, this.namespace).then(() => true);
         this.command.log(`Existing secret ${this.secretName} deleted`);
     }
-    async createSecret(secret) {
+    async createSecret(secret, labels) {
         this.command.log(`Creating secret ${this.secretName}`);
-        await this.coreV1Api.createNamespacedSecret(this.namespace, secret.toKubeSecret(this.secretName));
+        await this.coreV1Api.createNamespacedSecret(this.namespace, secret.toKubeSecret(this.secretName, labels));
         this.command.log(`Created secret ${this.secretName}`);
     }
-    async replaceSecret(secret) {
+    async replaceSecret(secret, labels) {
         this.command.log(`Replacing secret ${this.secretName}`);
-        await this.coreV1Api.replaceNamespacedSecret(this.secretName, this.namespace, secret.toKubeSecret(this.secretName));
+        await this.coreV1Api.replaceNamespacedSecret(this.secretName, this.namespace, secret.toKubeSecret(this.secretName, labels));
     }
 }
 exports.KubeApiService = KubeApiService;

package/dist/helpers/secret.d.ts

@@ -7,7 +7,7 @@ export declare class Secret {
     private command;
     constructor(command: Command);
     generateNew(): void;
-    toKubeSecret(secretName: string): V1Secret;
+    toKubeSecret(secretName: string, labels?: any): V1Secret;
     fromKubeSecret(kubeSecret: V1Secret): void;
     appendJWK(maxNumber: number): void;
     appendCookieKey(maxNumber: number): void;

package/dist/helpers/secret.js

@@ -19,9 +19,9 @@ class Secret {
         this.JWKs = [tslib_1.__classPrivateFieldGet(this, _Secret_instances, "m", _Secret_generateRSAJwk).call(this, 4096)];
         this.CookieKeys = [tslib_1.__classPrivateFieldGet(this, _Secret_instances, "m", _Secret_generateCookieKey).call(this, 32)];
     }
-    toKubeSecret(secretName) {
+    toKubeSecret(secretName, labels) {
         const secret = new client_node_1.V1Secret();
-        secret.metadata = tslib_1.__classPrivateFieldGet(this, _Secret_instances, "m", _Secret_getKubeSecretMetadata).call(this, secretName);
+        secret.metadata = tslib_1.__classPrivateFieldGet(this, _Secret_instances, "m", _Secret_getKubeSecretMetadata).call(this, secretName, labels);
         secret.data = {};
         secret.data[JWKSKeyName] = tslib_1.__classPrivateFieldGet(this, _Secret_instances, "m", _Secret_arrayToB64String).call(this, this.JWKs);
         secret.data[CookieKeysKeyName] = tslib_1.__classPrivateFieldGet(this, _Secret_instances, "m", _Secret_arrayToB64String).call(this, this.CookieKeys);
@@ -73,8 +73,11 @@ _Secret_instances = new WeakSet(), _Secret_append = function _Secret_append(prop
 }, _Secret_arrayToB64String = function _Secret_arrayToB64String(array) {
     const b = Buffer.from(JSON.stringify(array));
     return b.toString('base64');
-}, _Secret_getKubeSecretMetadata = function _Secret_getKubeSecretMetadata(secretName) {
+}, _Secret_getKubeSecretMetadata = function _Secret_getKubeSecretMetadata(secretName, labels) {
     const metaData = new client_node_1.V1ObjectMeta();
     metaData.name = secretName;
+    if (labels) {
+        metaData.labels = labels;
+    }
     return metaData;
 };

package/oclif.manifest.json

@@ -8,7 +8,8 @@
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %> -n <kube namespace> -s <secret name>",
-        "<%= config.bin %> <%= command.id %> --namespace <kube namespace> --secret <secret name> --recreate"
+        "<%= config.bin %> <%= command.id %> --namespace <kube namespace> --secret <secret name> --recreate",
+        "<%= config.bin %> <%= command.id %> --additional-label \"app.kubernetes.io/instance: passmower\""
       ],
       "flags": {
         "json": {
@@ -59,6 +60,18 @@
           ],
           "type": "option"
         },
+        "additionalLabel": {
+          "aliases": [
+            "additional-label"
+          ],
+          "char": "l",
+          "description": "Add custom Kubernetes label (may be repeated)",
+          "name": "additionalLabel",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
         "recreate": {
           "aliases": [
             "recreate"
@@ -134,6 +147,18 @@
           ],
           "type": "option"
         },
+        "additionalLabel": {
+          "aliases": [
+            "additional-label"
+          ],
+          "char": "l",
+          "description": "Add custom Kubernetes label (may be repeated)",
+          "name": "additionalLabel",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
         "both": {
           "description": "rotate both JWKs and cookie keys",
           "name": "both",
@@ -201,5 +226,5 @@
       ]
     }
   },
-  "version": "1.0.0"
+  "version": "1.1.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codemowers/oidc-key-manager",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "CLI to manage secret keys required by oidc-gateway",
   "author": "Erki Aas",
   "bin": {