kx-cli 0.0.10__tar.gz → 0.0.11__tar.gz

{kx_cli-0.0.10/src/kx_cli.egg-info → kx_cli-0.0.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kx-cli
-Version: 0.0.10
+Version: 0.0.11
 Summary: kubectl wrapper with index-based resource selection
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
@@ -92,14 +92,15 @@ pipx run --spec kx-cli kx get pods
 
 Known kinds can drop the `get`: `kx pods`, `kx deploy -n kube-system`, `kx svc --match api` — kubectl shorthands (`po`, `deploy`, `svc`, `sts`, ...) included. An integer after a kind relists just that index: `kx po 3`. CRDs and other resource types still use `kx get <resource>`.
 
-Global flags: `--no-color` disables styled output, `-v`/`--version` prints the installed version, and `--help` on any command shows usage, examples, and aliases.
+Global flags: `--no-color` disables styled output, `-v`/`--version` prints the installed version, and `-h`/`--help` on any command shows usage, examples, and aliases.
 
 ### Commands
 
 <!-- commands-table-start -->
 | Command | Description |
 |---|---|
-| `kx get <resource> [--match/-m str] [kubectl flags...]` | List resources and assign index numbers for use with other commands; shorthand: kx <kind> (e.g. kx pods, kx po 3). |
+| `kx get <resource> [--match/-m str] [--decode] [--key/-k str] [--yes/-y] [kubectl flags...]` | List resources and assign index numbers for use with other commands; shorthand: kx <kind> (e.g. kx pods, kx po 3). |
+| `kx secret [--match/-m str] [--decode] [--key/-k str] [--yes/-y] [kubectl flags...]` | List Secrets like kx get, or show an indexed Secret's data with --decode; alias: kx secrets. |
 | `kx top [--match/-m str] [--no-limits] [kubectl flags...]` | List CPU/memory usage for pods in the current namespace and assign index numbers, like kx get; shows usage as a percent of each pod's resource limits unless --no-limits. |
 | `kx describe <indexes>... [kubectl flags...]` | Show full kubectl describe output for one or more indexed resources. |
 | `kx events <indexes>...` | Show Kubernetes events for one or more indexed resources. |
@@ -113,7 +114,7 @@ Global flags: `--no-color` disables styled output, `-v`/`--version` prints the i
 | `kx delete <indexes>... [--yes/-y]` | Delete one or more indexed resources (prompts for confirmation unless --yes). |
 | `kx edit <index> [kubectl flags...]` | Open an indexed resource in your editor via kubectl edit. |
 | `kx exec <index> [<cmd>...] [kubectl flags...]` | Open an interactive shell in an indexed pod (bash, falling back to sh). |
-| `kx tree <index> [--index/-i]` | Show the ownership graph for an indexed resource; --index assigns indexes to tree nodes. |
+| `kx tree [<index>] [--index/-i]` | Show the ownership graph for an indexed resource, or the whole current namespace when no index is given; --index assigns indexes to tree nodes. A Namespace index graphs that namespace. |
 | `kx rollout <action> <index>` | Run a rollout action (status, restart, pause, resume, history, undo) on a Deployment, StatefulSet, or DaemonSet. |
 | `kx scale <index> <replicas>` | Scale an indexed Deployment, StatefulSet, or ReplicaSet to a given replica count. |
 | `kx port-forward <index> <port> [kubectl flags...]` | Forward a local port to an indexed resource (Pod, Deployment, ReplicaSet, StatefulSet, DaemonSet, Service). |
@@ -147,6 +148,21 @@ CronJob runs, usage near limits), a per-pod status table, recent log tails
 from broken containers, and warning events — one screen instead of four
 kubectl commands.
 
+### Read a Secret in plaintext
+
+`kx secret <index> --decode` prints an indexed Secret's keys and values
+decoded, instead of the base64 kubectl returns. Values that aren't text show a
+`<binary, N bytes>` placeholder rather than garbling the table. `--key`/`-k`
+prints a single value raw — no banner, no wrapping — so it drops straight into
+a shell: `export PGPASSWORD=$(kx secret 1 --decode -k password)`, or redirect a
+binary value to a file. Bare `kx secret --decode` decodes every Secret in the
+namespace in one call, `-n` included — it confirms first unless you pass
+`--yes`/`-y`, since that prints every credential in the namespace.
+
+<div align="center">
+  <img src="https://raw.githubusercontent.com/jzills/kx/main/demo/secret.gif" alt="kx secret --decode demo" width="800"/>
+</div>
+
 ### Scan images for vulnerabilities
 
 `kx scan <index>` scans the unique container images of an indexed workload

{kx_cli-0.0.10 → kx_cli-0.0.11}/README.md

@@ -69,14 +69,15 @@ pipx run --spec kx-cli kx get pods
 
 Known kinds can drop the `get`: `kx pods`, `kx deploy -n kube-system`, `kx svc --match api` — kubectl shorthands (`po`, `deploy`, `svc`, `sts`, ...) included. An integer after a kind relists just that index: `kx po 3`. CRDs and other resource types still use `kx get <resource>`.
 
-Global flags: `--no-color` disables styled output, `-v`/`--version` prints the installed version, and `--help` on any command shows usage, examples, and aliases.
+Global flags: `--no-color` disables styled output, `-v`/`--version` prints the installed version, and `-h`/`--help` on any command shows usage, examples, and aliases.
 
 ### Commands
 
 <!-- commands-table-start -->
 | Command | Description |
 |---|---|
-| `kx get <resource> [--match/-m str] [kubectl flags...]` | List resources and assign index numbers for use with other commands; shorthand: kx <kind> (e.g. kx pods, kx po 3). |
+| `kx get <resource> [--match/-m str] [--decode] [--key/-k str] [--yes/-y] [kubectl flags...]` | List resources and assign index numbers for use with other commands; shorthand: kx <kind> (e.g. kx pods, kx po 3). |
+| `kx secret [--match/-m str] [--decode] [--key/-k str] [--yes/-y] [kubectl flags...]` | List Secrets like kx get, or show an indexed Secret's data with --decode; alias: kx secrets. |
 | `kx top [--match/-m str] [--no-limits] [kubectl flags...]` | List CPU/memory usage for pods in the current namespace and assign index numbers, like kx get; shows usage as a percent of each pod's resource limits unless --no-limits. |
 | `kx describe <indexes>... [kubectl flags...]` | Show full kubectl describe output for one or more indexed resources. |
 | `kx events <indexes>...` | Show Kubernetes events for one or more indexed resources. |
@@ -90,7 +91,7 @@ Global flags: `--no-color` disables styled output, `-v`/`--version` prints the i
 | `kx delete <indexes>... [--yes/-y]` | Delete one or more indexed resources (prompts for confirmation unless --yes). |
 | `kx edit <index> [kubectl flags...]` | Open an indexed resource in your editor via kubectl edit. |
 | `kx exec <index> [<cmd>...] [kubectl flags...]` | Open an interactive shell in an indexed pod (bash, falling back to sh). |
-| `kx tree <index> [--index/-i]` | Show the ownership graph for an indexed resource; --index assigns indexes to tree nodes. |
+| `kx tree [<index>] [--index/-i]` | Show the ownership graph for an indexed resource, or the whole current namespace when no index is given; --index assigns indexes to tree nodes. A Namespace index graphs that namespace. |
 | `kx rollout <action> <index>` | Run a rollout action (status, restart, pause, resume, history, undo) on a Deployment, StatefulSet, or DaemonSet. |
 | `kx scale <index> <replicas>` | Scale an indexed Deployment, StatefulSet, or ReplicaSet to a given replica count. |
 | `kx port-forward <index> <port> [kubectl flags...]` | Forward a local port to an indexed resource (Pod, Deployment, ReplicaSet, StatefulSet, DaemonSet, Service). |
@@ -124,6 +125,21 @@ CronJob runs, usage near limits), a per-pod status table, recent log tails
 from broken containers, and warning events — one screen instead of four
 kubectl commands.
 
+### Read a Secret in plaintext
+
+`kx secret <index> --decode` prints an indexed Secret's keys and values
+decoded, instead of the base64 kubectl returns. Values that aren't text show a
+`<binary, N bytes>` placeholder rather than garbling the table. `--key`/`-k`
+prints a single value raw — no banner, no wrapping — so it drops straight into
+a shell: `export PGPASSWORD=$(kx secret 1 --decode -k password)`, or redirect a
+binary value to a file. Bare `kx secret --decode` decodes every Secret in the
+namespace in one call, `-n` included — it confirms first unless you pass
+`--yes`/`-y`, since that prints every credential in the namespace.
+
+<div align="center">
+  <img src="https://raw.githubusercontent.com/jzills/kx/main/demo/secret.gif" alt="kx secret --decode demo" width="800"/>
+</div>
+
 ### Scan images for vulnerabilities
 
 `kx scan <index>` scans the unique container images of an indexed workload

{kx_cli-0.0.10 → kx_cli-0.0.11}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kx-cli"
-version = "0.0.10"
+version = "0.0.11"
 description = "kubectl wrapper with index-based resource selection"
 readme = "README.md"
 requires-python = ">=3.11"

kx_cli-0.0.11/src/kx/commands/secret.py

@@ -0,0 +1,58 @@
+import base64
+import json
+
+from kx.kubectl import KubectlServiceProtocol
+from kx.state import StateServiceProtocol
+
+
+def to_display(value: bytes) -> str:
+    """Decoded text, or a placeholder for values that aren't valid UTF-8.
+
+    Keeps keystores and other binary payloads from garbling the table; `--key`
+    still emits their raw bytes so they can be redirected to a file."""
+    try:
+        return value.decode("utf-8")
+    except UnicodeDecodeError:
+        return f"<binary, {len(value)} bytes>"
+
+
+def _decode_data(obj: dict) -> dict[str, bytes]:
+    """Decoded `data` for one Secret object. Values stay `bytes` so the render
+    layer owns the text/binary decision. `stringData` is write-only and never
+    returned by the API, so `data` holds everything."""
+    return {
+        key: base64.b64decode(value) for key, value in (obj.get("data") or {}).items()
+    }
+
+
+class SecretCommand:
+    def __init__(self, state: StateServiceProtocol, kubectl: KubectlServiceProtocol):
+        self.state = state
+        self.kubectl = kubectl
+
+    def execute(self, index: int) -> dict[str, bytes]:
+        """Decoded data for the indexed Secret."""
+        name, namespace, kind = self.state.fields(index)
+        raw = self.kubectl.run(
+            ["get", kind, name, "-n", namespace, "-o", "json"],
+        )
+        return _decode_data(json.loads(raw))
+
+    def execute_all(
+        self, extra_args: list[str] | None = None
+    ) -> list[tuple[str, str, dict[str, bytes]]]:
+        """Every Secret in the target namespace as (name, namespace, data).
+
+        One kubectl call returns the whole list with data attached, so a
+        namespace sweep costs the same as a single fetch. `extra_args` carries
+        the user's kubectl flags so `-n` selects the namespace."""
+        raw = self.kubectl.run(["get", "secret", "-o", "json", *(extra_args or [])])
+        obj = json.loads(raw)
+        return [
+            (
+                item.get("metadata", {}).get("name", ""),
+                item.get("metadata", {}).get("namespace", ""),
+                _decode_data(item),
+            )
+            for item in obj.get("items") or []
+        ]

kx_cli-0.0.11/src/kx/commands/tree.py

@@ -0,0 +1,65 @@
+from rich.tree import Tree
+
+from kx.kinds import Kind
+from kx.kubectl import KubectlServiceProtocol
+from kx.state import State, StateServiceProtocol
+from kx.types import (
+    BuildIndexedTree,
+    BuildNamespaceIndexedTree,
+    BuildNamespaceTree,
+    BuildTree,
+)
+
+
+class TreeCommand:
+    def __init__(
+        self,
+        state: StateServiceProtocol,
+        kubectl: KubectlServiceProtocol,
+        build_tree: BuildTree,
+        build_indexed_tree: BuildIndexedTree,
+        build_namespace_tree: BuildNamespaceTree,
+        build_namespace_indexed_tree: BuildNamespaceIndexedTree,
+    ):
+        self.state = state
+        self.kubectl = kubectl
+        self.build_tree = build_tree
+        self.build_indexed_tree = build_indexed_tree
+        self.build_namespace_tree = build_namespace_tree
+        self.build_namespace_indexed_tree = build_namespace_indexed_tree
+
+    def execute(self, index: int, indexed: bool = False) -> Tree:
+        name, namespace, kind = self.state.fields(index)
+        # A Namespace row walks that namespace itself — its own name, not the
+        # namespace the `kx get ns` was run in.
+        if kind == Kind.Namespace:
+            return self._namespace(name, indexed)
+        if indexed:
+            tree, resources = self.build_indexed_tree(kind, name, namespace)
+            if resources:
+                self.state.save(
+                    State(
+                        resources={name: kind for name, kind in resources},
+                        namespace=namespace,
+                    )
+                )
+        else:
+            tree = self.build_tree(kind, name, namespace)
+        return tree
+
+    def execute_namespace(self, namespace: str, indexed: bool = False) -> Tree:
+        return self._namespace(namespace, indexed)
+
+    def _namespace(self, namespace: str, indexed: bool) -> Tree:
+        if indexed:
+            tree, resources = self.build_namespace_indexed_tree(namespace)
+            if resources:
+                self.state.save(
+                    State(
+                        resources={name: kind for name, kind in resources},
+                        namespace=namespace,
+                    )
+                )
+        else:
+            tree = self.build_namespace_tree(namespace)
+        return tree

{kx_cli-0.0.10 → kx_cli-0.0.11}/src/kx/console.py

@@ -1,5 +1,6 @@
 import re
 import json
+import sys
 import threading
 from contextlib import contextmanager
 from datetime import datetime, timezone
@@ -194,6 +195,25 @@ def print_raw(text: str) -> None:
     _console.print(text, markup=False, highlight=False)
 
 
+def write_value(value: bytes) -> None:
+    """Write a secret value to stdout unstyled, bypassing Rich entirely.
+
+    Rich wraps at the console width (_PIPE_WIDTH off-terminal), which would
+    inject newlines into a long value — a cert or token — and corrupt
+    `$(kx secret 1 --decode -k tls.crt)`. Writing to the byte buffer also keeps
+    `> store.p12` byte-exact. The trailing newline is added only for text, so
+    binary redirects reproduce the file exactly while text stays shell-friendly.
+    """
+    try:
+        value.decode("utf-8")
+    except UnicodeDecodeError:
+        payload = value
+    else:
+        payload = value + b"\n"
+    sys.stdout.buffer.write(payload)
+    sys.stdout.buffer.flush()
+
+
 def print_rich(renderable) -> None:
     _console.print(renderable)
 
@@ -667,7 +687,7 @@ def print_command_help(ctx) -> None:
         names = "  ".join(opt.opts)
         _console.print(f"  [body]{names:<20}[/body]  [muted]{opt.help or ''}[/muted]")
     _console.print(
-        f"  [body]{'--help':<20}[/body]  [muted]Show this message and exit.[/muted]"
+        f"  [body]{'-h, --help':<20}[/body]  [muted]Show this message and exit.[/muted]"
     )
 
     aliases = getattr(ctx.command.callback, "_aliases", [])
@@ -725,7 +745,7 @@ def print_help(
         f"  [body]{'-v, --version':<14}[/body]  [muted]Show the kx version and exit.[/muted]"
     )
     _console.print(
-        f"  [body]{'--help':<14}[/body]  [muted]Show this message and exit.[/muted]"
+        f"  [body]{'-h, --help':<14}[/body]  [muted]Show this message and exit.[/muted]"
     )
     if version:
         _console.print()

{kx_cli-0.0.10 → kx_cli-0.0.11}/src/kx/graph.py

@@ -16,6 +16,17 @@ def build_indexed_tree(
     return _build(kind, name, namespace, indexed=True)
 
 
+def build_namespace_tree(namespace: str) -> Tree:
+    root, _ = _build_namespace(namespace, indexed=False)
+    return root
+
+
+def build_namespace_indexed_tree(
+    namespace: str,
+) -> tuple[Tree, list[tuple[str, str]]]:
+    return _build_namespace(namespace, indexed=True)
+
+
 def _build(
     kind: str, name: str, namespace: str, indexed: bool
 ) -> tuple[Tree, list[tuple[str, str]]]:
@@ -54,6 +65,115 @@ def _build(
     return root, resources
 
 
+# Prefix + semantic color for each node kind in a namespace forest. Controllers
+# render as roots with their full kind name; owned resources use the short
+# prefixes the single-resource tree already uses (rs/job/pod).
+_NODE_STYLE: dict[Kind, tuple[str, str]] = {
+    Kind.Deployment: ("Deployment", "header"),
+    Kind.StatefulSet: ("StatefulSet", "header"),
+    Kind.DaemonSet: ("DaemonSet", "header"),
+    Kind.CronJob: ("CronJob", "header"),
+    Kind.Job: ("job", "accent"),
+    Kind.ReplicaSet: ("rs", "accent"),
+    Kind.Pod: ("pod", "body"),
+}
+
+# Stable order roots appear under the Namespace node.
+_ROOT_ORDER: list[Kind] = [
+    Kind.Deployment,
+    Kind.StatefulSet,
+    Kind.DaemonSet,
+    Kind.CronJob,
+    Kind.Job,
+    Kind.ReplicaSet,
+    Kind.Pod,
+]
+
+
+def _build_namespace(
+    namespace: str, indexed: bool
+) -> tuple[Tree, list[tuple[str, str]]]:
+    """Full ownership forest for a namespace: every workload controller as a
+    root with its owned resources beneath, plus orphan Jobs/ReplicaSets and bare
+    Pods so nothing is hidden. Each pod appears exactly once. Unlike `_build`,
+    the Namespace root node is not indexed — children number from 1."""
+    load_config()
+    apps = client.AppsV1Api()
+    core = client.CoreV1Api()
+    batch = client.BatchV1Api()
+
+    deployments = apps.list_namespaced_deployment(namespace).items
+    replica_sets = apps.list_namespaced_replica_set(namespace).items
+    stateful_sets = apps.list_namespaced_stateful_set(namespace).items
+    daemon_sets = apps.list_namespaced_daemon_set(namespace).items
+    cron_jobs = batch.list_namespaced_cron_job(namespace).items
+    jobs = batch.list_namespaced_job(namespace).items
+    pods = core.list_namespaced_pod(namespace).items
+
+    # Resources that can be owned by something else in the namespace, indexed by
+    # each owner uid so a parent finds its children in one pass.
+    child_kinds = (
+        [(rs, Kind.ReplicaSet) for rs in replica_sets]
+        + [(job, Kind.Job) for job in jobs]
+        + [(pod, Kind.Pod) for pod in pods]
+    )
+    children_by_owner: dict[str, list[tuple[object, Kind]]] = {}
+    for obj, kind in child_kinds:
+        for ref in obj.metadata.owner_references or []:
+            children_by_owner.setdefault(ref.uid, []).append((obj, kind))
+
+    present_uids = {
+        obj.metadata.uid
+        for obj in (
+            *deployments,
+            *replica_sets,
+            *stateful_sets,
+            *daemon_sets,
+            *cron_jobs,
+            *jobs,
+            *pods,
+        )
+    }
+
+    # Controllers are always roots; an owned child (rs/job/pod) is a root only
+    # when orphaned — its owner isn't among the namespace's collected objects.
+    roots: list[tuple[object, Kind]] = [
+        *[(d, Kind.Deployment) for d in deployments],
+        *[(s, Kind.StatefulSet) for s in stateful_sets],
+        *[(d, Kind.DaemonSet) for d in daemon_sets],
+        *[(c, Kind.CronJob) for c in cron_jobs],
+    ]
+    for obj, kind in child_kinds:
+        refs = obj.metadata.owner_references or []
+        if not any(ref.uid in present_uids for ref in refs):
+            roots.append((obj, kind))
+
+    order = {kind: position for position, kind in enumerate(_ROOT_ORDER)}
+    roots.sort(key=lambda pair: (order[pair[1]], pair[0].metadata.name))
+
+    resources: list[tuple[str, str]] = []
+    root = Tree(f"[header]Namespace/{namespace}[/header]")
+    if not roots:
+        root.add("[muted](no workloads)[/muted]")
+        return root, resources
+
+    for obj, kind in roots:
+        _render(obj, kind, root, children_by_owner, resources, indexed)
+    return root, resources
+
+
+def _render(obj, kind, parent, children_by_owner, resources, indexed):
+    """Add `obj` under `parent`, then recurse into its owned children; a Pod is
+    a leaf whose containers are listed directly."""
+    prefix, color = _NODE_STYLE[kind]
+    node = _add_node(parent, resources, indexed, color, prefix, obj.metadata.name, kind)
+    if kind == Kind.Pod:
+        _add_containers(obj, node)
+        return
+    for child, child_kind in children_by_owner.get(obj.metadata.uid, []):
+        _render(child, child_kind, node, children_by_owner, resources, indexed)
+
+
 def _add_node(parent, resources, indexed, color, prefix, name, kind):
     """Add a labelled child node; when indexed, prepend its 1-based index and
     record `(name, kind)` in `resources`."""