如何便捷编辑Kubernetes Secrets？含明文查看、提取等相关问题咨询

Hey there! Let's break down each of your questions about Kubernetes Secrets one by one—these are all super common pain points, so I’ve got you covered:

1. Can I mount Secrets to a local volume? #

Not directly to your local host’s filesystem, but you can mount Secrets as a volume inside a Kubernetes Pod. Once mounted, the Secret values are automatically decoded into plaintext files that your container can read. Here’s a quick example of how to set this up in a Pod manifest:

apiVersion: v1
kind: Pod
metadata:
  name: secret-test-pod
spec:
  containers:
  - name: test-container
    image: busybox:latest
    command: ["sleep", "3600"]
    volumeMounts:
    - name: secret-volume
      mountPath: /etc/secrets
      readOnly: true
  volumes:
  - name: secret-volume
    secret:
      secretName: mysecret

After creating this Pod, you can exec into it and check the plaintext values:

kubectl exec -it secret-test-pod -- cat /etc/secrets/my-key

2. Can I extract Secrets to my local machine for editing? #

Absolutely! You can pull the Secret to your local system, decode the values, edit them, then re-encode and push the changes back. Here’s a step-by-step workflow:

1. Export the Secret to a local YAML file:

   kubectl get secret mysecret -o yaml > mysecret.yaml
   

2. Decode the base64 values to plaintext:
   For a specific key (e.g., db-password):

   grep "db-password" mysecret.yaml | awk '{print $2}' | base64 -d > db-password.txt
   

   Edit db-password.txt with your new value.

3. Re-encode the plaintext to base64:

   NEW_VALUE=$(base64 -w 0 db-password.txt)
   

4. Update the YAML file with the new base64 string, then apply the changes:

   kubectl apply -f mysecret.yaml
   

A faster alternative for single keys: skip editing YAML entirely and update directly with plaintext:

kubectl create secret generic mysecret --from-literal=db-password="new-plaintext-value" --dry-run=client -o yaml | kubectl apply -f -

3. Is there a way to view/edit keys/values in plaintext (or a single key)? #

Viewing plaintext values #

• For all keys in a Secret:

  kubectl get secret mysecret -o json | jq '.data | to_entries[] | .key + ": " + (.value | @base64d)'
  

• For a single key:

  kubectl get secret mysecret -o jsonpath='{.data.db-password}' | base64 -d
  

Editing in plaintext #

Instead of dealing with base64 in kubectl edit, use the --from-literal or --from-file flags to update Secrets directly with plaintext:

• Update a single key:

  kubectl patch secret mysecret -p '{"data": {"db-password": "'$(echo -n "new-value" | base64 -w 0)'"}}'
  

Or even simpler (no manual base64):

kubectl create secret generic mysecret --from-literal=db-password="new-value" --dry-run=client -o yaml | kubectl apply -f -

If you do use kubectl edit, just remember to replace the base64 string with the base64-encoded version of your new plaintext value (generate it with echo -n "new-value" | base64).

4. How to view only the Secret keys (without values) using kubectl? #

There are a few quick ways to list just the keys:

• Using jsonpath directly:

  kubectl get secret mysecret -o jsonpath='{keys .data}'
  

• Using jq for cleaner formatting:

  kubectl get secret mysecret -o json | jq '.data | keys'
  

• For a plain list (no brackets):

  kubectl get secret mysecret -o json | jq -r '.data | keys[]'
  

内容的提问来源于stack exchange，提问作者nmiculinic