Support replacing kops secrets via force flag

[KashifSaadat]

• Return an error when attempting to create a secret if it already exists (previously it would silently return with a successful exit code, which is misleading).
• Allow passing a --force flag when creating encryptionconfig or dockerconfig secrets, so they can be replaced if they already exist.
• Fixes Unable to update an existing kops secret with a new value #3895

[KashifSaadat]

/assign @chrislovecnm @justinsb

What do you think, is this new behaviour ok or would you see it implemented differently?

Example usage:

➜  kops git:(kops-secret-force-update) ✗ kops create secret --name ${KOPS_CLUSTER_NAME} encryptionconfig -f encryptionConfigEnabled.yaml -v 10
s3context.go:163] Found bucket "${KOPS_BUCKET_NAME}" in region "${AWS_REGION}"
s3fs.go:176] Reading file "s3://${KOPS_BUCKET_NAME}/${KOPS_CLUSTER_NAME}/config"
s3fs.go:176] Reading file "s3://${KOPS_BUCKET_NAME}/${KOPS_CLUSTER_NAME}/secrets/encryptionconfig"

failed to create the encryptionconfig secret as it already exists. The `--force` flag can be passed to replace an existing secret.

➜  kops git:(kops-secret-force-update) ✗ echo $?
1

➜  kops git:(kops-secret-force-update) ✗ kops create secret --name ${KOPS_CLUSTER_NAME} encryptionconfig -f encryptionConfigEnabled.yaml --force -v 10
s3context.go:163] Found bucket "${KOPS_BUCKET_NAME}" in region "${AWS_REGION}"
s3fs.go:176] Reading file "s3://${KOPS_BUCKET_NAME}/${KOPS_CLUSTER_NAME}/config"
s3fs.go:113] Writing file "s3://${KOPS_BUCKET_NAME}/${KOPS_CLUSTER_NAME}/secrets/encryptionconfig"
s3fs.go:133] Calling S3 PutObject Bucket="${KOPS_BUCKET_NAME}" Key="${KOPS_CLUSTER_NAME}/secrets/encryptionconfig" SSE="AES256" ACL="" BodyLen=275
s3fs.go:176] Reading file "s3://${KOPS_BUCKET_NAME}/${KOPS_CLUSTER_NAME}/secrets/encryptionconfig"

➜  kops git:(kops-secret-force-update) ✗ echo $?
0

[justinsb]

Challenge here:I think Update fails if the secret doesn't exist. You would have to read it first.

[justinsb]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

• OWNERS [justinsb]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[k8s-github-robot]

/test all [submit-queue is verifying that this PR is safe to merge]

[justinsb]

Opened #3902 to track that maybe-issue

[k8s-github-robot]

Automatic merge from submit-queue.