Feature request: Support reading secrets from terminal in kubectl

[tamalsaha]

kubectl create secret command supports --from-literal and --from-file options. But neither options are convenient when creating secrets manually from terminal.

• Using -- from-literal will keep the secret in shell history.
• Using --from-file requires creating the file first and then deleting it, etc.

I would like to see a flag like --from-keys=k1,k2,k3. Given this flag is present, kubectl will ask user for input for each key and create a secret using that info. It can use something like https://github.com/howeyc/gopass to read the value without echo.

/kind feature
/sig cli

[php-coder]

Because in Unix terminal is represented as file /dev/stdin, you can use the following command:

$ kubectl create secret generic foo --from-file=test=/dev/stdin
tada <-- this was manually typed in a terminal
secret "foo" created
$ kubectl get secret foo -o yaml | grep ^data: -A1
data:
  test: dGFkYQo=
$ echo -n dGFkYQo= | base64 -d
tada

[tamalsaha]

Thanks @php-coder ! I guess this works in linux / mc. Windows users will be out of luck.

[tamalsaha]

@php-coder , I just tried this in Ubuntu 16.04. How to I end the read process? I tried pressing Enter but the read did not close.

[php-coder]

I tried pressing Enter but the read did not close.

Yes, I forgot to mention that you should use Ctrl+D to quit :)

[tamalsaha]

:) It worked after ctrl + D. I even tried with multiple keys.

I think one issue still remains in that I don't know in what order the keys are read by kubectl. A common scenario is creating AWS credentials. If kubectl can prompt back the secret, that will make things bit nicer.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[sureshamk]

I use this handy method

kubectl get secrets <secretname> -o json | jq '.data | map_values(@base64d)'