feat: implement pod-specific secret injection for DaemonSets with automated lifecycle management

cmd/secret-manager/README.md

@@ -0,0 +1,55 @@
+# Secret Manager
+
+A simple CLI tool to manage Kubernetes Secrets from your local machine. It handles Base64 encoding/decoding automatically, allowing you to work with plain text values.
+
+## Features
+
+- **List**: View all keys and values in a secret (decoded).
+- **Add/Update**: Add a new key-value pair or update an existing one using plain text.
+- **Delete**: Remove a specific key from a secret.
+
+## Prerequisites
+
+- Local `kubeconfig` file (usually at `~/.kube/config`).
+- `cluster-admin` or sufficient RBAC permissions to manage secrets in the target namespace.
+
+## Build
+
+From the root of the repository:
+
+```bash
+make build
+# The binary will be located at bin/secret-manager
+```
+
+## Usage
+
+```bash
+./bin/secret-manager --secret <name> [options]
+```
+
+### Options
+
+- `--namespace`: Namespace of the secret (default: `default`).
+- `--secret`: **(Required)** Name of the Kubernetes secret.
+- `--op`: Operation to perform: `list`, `add`, or `delete` (default: `list`).
+- `--key`: The key to add or delete.
+- `--value`: The plain text value to add (required for `add` operation).
+- `--kubeconfig`: Path to a custom kubeconfig file.
+
+### Examples
+
+**1. List keys and values:**
+```bash
+./bin/secret-manager --namespace gps-system --secret test-daemonset-7v1v1 --op list
+```
+
+**2. Add or update a key:**
+```bash
+./bin/secret-manager --namespace gps-system --secret test-daemonset-7v1v1 --op add --key my-key --value "my-value"
+```
+
+**3. Delete a key:**
+```bash
+./bin/secret-manager --namespace gps-system --secret test-daemonset-7v1v1 --op delete --key my-key
+```

cmd/secret-manager/main.go

@@ -0,0 +1,101 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+	"k8s.io/client-go/util/homedir"
+)
+
+func main() {
+	var kubeconfig *string
+	if home := homedir.HomeDir(); home != "" {
+		kubeconfig = flag.String("kubeconfig", filepath.Join(home, ".kube", "config"), "(optional) absolute path to the kubeconfig file")
+	} else {
+		kubeconfig = flag.String("kubeconfig", "", "absolute path to the kubeconfig file")
+	}
+
+	var namespace string
+	var secretName string
+	var operation string
+	var key string
+	var value string
+
+	flag.StringVar(&namespace, "namespace", "default", "Namespace of the secret")
+	flag.StringVar(&secretName, "secret", "", "Name of the secret")
+	flag.StringVar(&operation, "op", "list", "Operation: add, delete, list")
+	flag.StringVar(&key, "key", "", "Key for add/delete operation")
+	flag.StringVar(&value, "value", "", "Value for add operation")
+	flag.Parse()
+
+	if secretName == "" {
+		fmt.Println("Usage: secret-manager --secret <name> [--namespace <ns>] [--op <add|delete|list>] [--key <k>] [--value <v>]")
+		os.Exit(1)
+	}
+
+	config, err := clientcmd.BuildConfigFromFlags("", *kubeconfig)
+	if err != nil {
+		log.Fatalf("Error building kubeconfig: %v", err)
+	}
+
+	clientset, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		log.Fatalf("Error creating clientset: %v", err)
+	}
+
+	ctx := context.TODO()
+	secret, err := clientset.CoreV1().Secrets(namespace).Get(ctx, secretName, metav1.GetOptions{})
+	if err != nil {
+		log.Fatalf("Error getting secret %s/%s: %v", namespace, secretName, err)
+	}
+
+	switch operation {
+	case "list":
+		fmt.Printf("Content of secret %s/%s:\n", namespace, secretName)
+		if len(secret.Data) == 0 {
+			fmt.Println("  (empty)")
+		}
+		for k, v := range secret.Data {
+			fmt.Printf("  - %s: %s\n", k, string(v))
+		}
+
+	case "add":
+		if key == "" || value == "" {
+			log.Fatal("Error: --key and --value are required for 'add' operation")
+		}
+		if secret.Data == nil {
+			secret.Data = make(map[string][]byte)
+		}
+		secret.Data[key] = []byte(value)
+		_, err = clientset.CoreV1().Secrets(namespace).Update(ctx, secret, metav1.UpdateOptions{})
+		if err != nil {
+			log.Fatalf("Error updating secret: %v", err)
+		}
+		fmt.Printf("Successfully added/updated key '%s' in secret %s/%s\n", key, namespace, secretName)
+
+	case "delete":
+		if key == "" {
+			log.Fatal("Error: --key is required for 'delete' operation")
+		}
+		if _, ok := secret.Data[key]; !ok {
+			fmt.Printf("Warning: Key '%s' not found in secret %s/%s\n", key, namespace, secretName)
+			return
+		}
+		delete(secret.Data, key)
+		_, err = clientset.CoreV1().Secrets(namespace).Update(ctx, secret, metav1.UpdateOptions{})
+		if err != nil {
+			log.Fatalf("Error updating secret: %v", err)
+		}
+		fmt.Printf("Successfully deleted key '%s' from secret %s/%s\n", key, namespace, secretName)
+
+	default:
+		log.Fatalf("Unknown operation: %s. Use list, add, or delete.", operation)
+	}
+}