Skip to content
This repository was archived by the owner on Aug 8, 2025. It is now read-only.

Issue/#114 cli editor support#121

Merged
ddgenome merged 30 commits intoatomist:masterfrom
timothysparg:issue/#114-cli-editor-support
Nov 25, 2019
Merged

Issue/#114 cli editor support#121
ddgenome merged 30 commits intoatomist:masterfrom
timothysparg:issue/#114-cli-editor-support

Conversation

@timothysparg
Copy link
Copy Markdown
Contributor

Resolves #114

@timothysparg
Copy link
Copy Markdown
Contributor Author

Is there a better way to structure this for testing?

Copy link
Copy Markdown
Contributor

@ddgenome ddgenome left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems the edit capability is neither part of kube-encrypt or kube-decrypt, since what you really want is a round trip, decrypt-edit-encrypt. Maybe it should be its own command, kube-edit.

Comment thread lib/kubeCrypt.ts Outdated
Comment thread lib/kubeCrypt.ts Outdated
Comment thread lib/kubeCrypt.ts Outdated
Comment thread package.json Outdated
Comment thread lib/kubeCrypt.ts Outdated
Co-Authored-By: David Dooling <dooling@gmail.com>
@ddgenome
Copy link
Copy Markdown
Contributor

Regarding test, for starters you could set the editor to true and ensure that the round trip leaves the content unmodified. You could also test using sed, if you are on a system likely to have it.

@ddgenome ddgenome self-assigned this Oct 24, 2019
@timothysparg
Copy link
Copy Markdown
Contributor Author

It seems the edit capability is neither part of kube-encrypt or kube-decrypt, since what you really want is a round trip, decrypt-edit-encrypt. Maybe it should be its own command, kube-edit.

ok, let me rework as it's own command and see how that looks.

@timothysparg
Copy link
Copy Markdown
Contributor Author

@ddgenome do you mind having a look and seeing if this is heading in the right direction?

Comment thread lib/kubeEdit.ts Outdated
Copy link
Copy Markdown
Contributor

@ddgenome ddgenome left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like a good start. I couple guiding questions that may make the implementation easier.

Comment thread index.ts Outdated
Comment thread index.ts Outdated
Comment thread index.ts Outdated
Comment thread lib/kubeEdit.ts Outdated
Comment thread lib/kubeEdit.ts Outdated
@timothysparg
Copy link
Copy Markdown
Contributor Author

timothysparg commented Oct 31, 2019

It looks like a good start. I couple guiding questions that may make the implementation easier.

With regard to the questions about the cli options, would it then make sense to introduce a --save option, or would we leave that up to the user ie kube-edit --file=blah --secret-key=🔑 >> blah

@ddgenome
Copy link
Copy Markdown
Contributor

When would you not want to save? I am thinking the kube-edit command takes an encoded and optionally encrypted secret spec, optionally decrypts, decodes, writes that to a temp file, opens an editor on that file, waits for the editor to exit, reads the file back in, encodes, optionally encrypts, and writes that to the original file.

This pattern is useful for GitOps users, so you can always recover the original contents of the secret spec from the Git history.

@timothysparg
Copy link
Copy Markdown
Contributor Author

ah ok, I missed that initially - thought we would just be writing to std out.

@timothysparg
Copy link
Copy Markdown
Contributor Author

@ddgenome mind having a look when you have a chance?

Copy link
Copy Markdown
Contributor

@ddgenome ddgenome left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is looking good. Great tests. A few minor things. Thanks for sticking with it!

Comment thread index.ts Outdated
parameterName: "file",
describe: "Edit Kubernetes secret data values from secret spec file",
type: "string",
required: true,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry I was not clearer on this before. I think having a required option is an oxymoron. If people have to provide it, why make them type --file=? Just grab it from argv._ and complain if it is not there.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've changed this to use a positional argument, which seems to work pretty well

Comment thread lib/kubeCrypt.ts Outdated
try {
secret = await handleSecretParameter(opts);
} catch (e) {
print.error(`Failed to load secret spec from file '${opts.file}': ${e.message}`);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This error message is not accurate anymore. Perhaps all the try/catch should be in the handleSecretParameter functions.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That try/catch is used more for exit handling than anything else, would then need to move exit (code) handling into the handleSecretParameter function, which feels a little inconsistent as the crypt method also uses the same pattern for exit code handling

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since only the reading of the file can throw an error, it seems to make sense to handle that issue there and use a different mechanism, e.g., returning undefined, to signal a failure of the function that then results in exit status handling.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah ok, that makes sense. Will update accordingly

Comment thread lib/kubeEdit.ts Outdated
Comment thread test/kubeUtils.test.ts Outdated
Comment thread test/kubeUtils.test.ts Outdated
Comment thread test/kubeUtils.test.ts Outdated
@timothysparg
Copy link
Copy Markdown
Contributor Author

@ddgenome do you mind reviewing again?

Comment thread lib/kubeCrypt.ts Outdated
try {
secret = await handleSecretParameter(opts);
} catch (e) {
print.error(`Failed to load secret spec from ${opts.file ? `'${opts.file}'` : "--file or --literal"}: ${e.message}`);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If opts.file is not truthy, why would you say "--file or --literal"?

Comment thread lib/kubeCrypt.ts Outdated
try {
secret = await handleSecretParameter(opts);
} catch (e) {
print.error(`Failed to load secret spec from file '${opts.file}': ${e.message}`);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since only the reading of the file can throw an error, it seems to make sense to handle that issue there and use a different mechanism, e.g., returning undefined, to signal a failure of the function that then results in exit status handling.

Copy link
Copy Markdown
Contributor

@ddgenome ddgenome left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm still not sold on the file error handling, but if you feel strongly that it should be this way, I'm okay with merging.

@timothysparg
Copy link
Copy Markdown
Contributor Author

@ddgenome

I've updated the PR with the latest changes:

I would really like to add some interactive cli testing ( the suppose package looks particularly promising for this ) - but I think that is for another pull request

@ddgenome ddgenome added auto-merge-method:squash Auto-merge with squash and merge auto-merge:on-approve Auto-merge on review approvals changelog:added Add this issue or pull request to added changelog section labels Nov 25, 2019
Copy link
Copy Markdown
Contributor

@ddgenome ddgenome left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ddgenome ddgenome merged commit 2831483 into atomist:master Nov 25, 2019
atomist Bot pushed a commit that referenced this pull request Nov 25, 2019
[atomist:generated]
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

auto-merge:on-approve Auto-merge on review approvals auto-merge-method:squash Auto-merge with squash and merge changelog:added Add this issue or pull request to added changelog section

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add kube-decrypt/encrypt support for modifying secrets directly in editor

2 participants