decode-all-kubernetes-secrets.sh

#!/bin/bash

usage="usage: decode-all-kubernetes-secrets.sh [context] [namespace]"
context=${1:-}
namespace=${2:-}
if [[ -z "$context" ]]; then
  echo "Missing context"
  echo "$usage"
  exit 1
fi
if [[ -z "$namespace" ]]; then
  echo "Missing namespace"
  echo "$usage"
  exit 1
fi

# Check dependencies
expected="kubectl jq base64"
for expect in $expected; do
  if ! command -v "$expect" > /dev/null; then
    echo "Missing dependency: $expect"
    exit 1
  fi
done

# Mac OSX base64 uses a capital D to base64 decode. All others use lowercase
base64Flag="-d"
if [[ "$(uname)" == "Darwin" ]]; then base64Flag="-D"; fi
kubectl="kubectl --context $context --namespace $namespace"
echo "SGFja2VyIFZvaWNlOiBJJ20gaW4uCg==" | base64 $base64Flag
echo "-------------------------------"
for secret_name in $($kubectl get secrets |  awk '{print $1}' | grep -viE 'name|default'); do
  echo "$secret_name"
  for key in $($kubectl get secret $secret_name -o json | jq -r '.data | keys | .[]'); do
    secret=$($kubectl get secret $secret_name -o json | jq -r '.data["'$key'"]' | base64 $base64Flag)
    echo "  - $key"
    echo "$secret"
  done
  echo "-------------------------------"
done