kubectl-decode

A kubectl plugin that decodes base64-encoded values in Kubernetes secrets, making them easily readable.

Features

• 🔓 Decode all secret values with a single command
• 📋 Multiple output formats: JSON, YAML, and table
• 🎯 Namespace and context support
• 📝 Helpful error messages with secret listing
• ✅ Dependency validation on startup

Dependencies

• kubectl - Kubernetes command-line tool (installation guide)
• jq - JSON processor (installation guide)
• yq (optional) - For better YAML formatting (installation guide)

Installation

Option 1: Manual Installation

1. Download or clone this repository
2. Make the script executable:

   chmod +x kubectl-decode

3. Move it to a directory in your PATH:

   mv kubectl-decode /usr/local/bin/
   # or
   mv kubectl-decode ~/bin/

Option 2: Via Krew (Future)

Once published to the Krew plugin index:

kubectl krew install decode

See KREW_DISTRIBUTION.md for information on publishing to Krew.

Usage

Basic Usage

Decode a secret in the current namespace:

kubectl decode my-secret

Output Formats

JSON format (default):

kubectl decode docker-registry
# or explicitly
kubectl decode docker-registry -o json

Output:

{
  ".dockerconfigjson": "{\n  \"auths\": {\n    \"docker.io\": {\n      \"auth\": \"dXNlcjpwYXNz\"\n    }\n  }\n}"
}

YAML format:

kubectl decode my-secret -o yaml

Table format (human-readable):

kubectl decode my-secret -o table

Output:

KEY                VALUE
---                -----
username           admin
password           super-secret-password
database           production-db

Namespace and Context

Specify namespace:

kubectl decode my-secret -n kube-system
kubectl decode my-secret --namespace production

Specify context:

kubectl decode my-secret --context staging-cluster

Combine flags:

kubectl decode my-secret -n dev --context staging -o table

Other Commands

Show help:

kubectl decode --help

Show version:

kubectl decode version

Show current KUBECONFIG:

kubectl decode config

Error Handling

If you don't specify a secret name, the plugin will show available secrets:

$ kubectl decode
Error: Missing name of secret
Run 'kubectl decode --help' for usage information

Available secrets:
NAME                 TYPE                                  DATA   AGE
docker-registry      kubernetes.io/dockerconfigjson        1      5d
my-secret            Opaque                                3      2d

Reference

Based on the kubectl plugin documentation