Initial release: Headlamp Sealed Secrets plugin v0.1.0

Features: - Complete SealedSecret CRD integration with Headlamp - Client-side encryption using controller's public key - Support for all three scoping modes (strict, namespace-wide, cluster-wide) - List and detail views for SealedSecrets - Encryption dialog for creating new SealedSecrets - Decryption support with RBAC awareness - Sealing keys management - Settings page for controller configuration - Integration with Secret detail view Technical: - Full TypeScript with strict mode - ~1,345 lines of code - Build size: 339.42 kB (93.21 kB gzipped) - Compatible with Headlamp v0.13.0+ - Apache 2.0 license Security: - All encryption performed client-side - RSA-OAEP + AES-256-GCM (kubeseal-compatible) - Auto-hide decrypted values after 30 seconds Closes: Initial implementation
2026-02-11 20:31:20 -05:00
commit dddbd30677
27 changed files with 21162 additions and 0 deletions
@@ -0,0 +1,93 @@
+/**
+ * SealedSecret Custom Resource Definition
+ */
+
+import { apiFactoryWithNamespace } from '@kinvolk/headlamp-plugin/lib/lib/k8s/apiProxy';
+import { KubeObject } from '@kinvolk/headlamp-plugin/lib/lib/k8s/cluster';
+import {
+  SealedSecretInterface,
+  SealedSecretScope,
+  SealedSecretSpec,
+  SealedSecretStatus,
+} from '../types';
+
+/**
+ * SealedSecret CRD class
+ * Represents a Bitnami Sealed Secret resource in the cluster
+ */
+export class SealedSecret extends KubeObject<SealedSecretInterface> {
+  /**
+   * API endpoint for SealedSecret resources
+   * bitnami.com/v1alpha1/sealedsecrets
+   */
+  static apiEndpoint = apiFactoryWithNamespace('bitnami.com', 'v1alpha1', 'sealedsecrets');
+
+  /**
+   * Class name used for Headlamp registration
+   */
+  static get className(): string {
+    return 'SealedSecret';
+  }
+
+  /**
+   * Get the SealedSecret spec
+   */
+  get spec(): SealedSecretSpec {
+    return this.jsonData.spec;
+  }
+
+  /**
+   * Get the SealedSecret status
+   */
+  get status(): SealedSecretStatus | undefined {
+    return this.jsonData.status;
+  }
+
+  /**
+   * Get the scope of this SealedSecret (strict, namespace-wide, or cluster-wide)
+   */
+  get scope(): SealedSecretScope {
+    const annotations = this.metadata.annotations || {};
+
+    if (annotations['sealedsecrets.bitnami.com/cluster-wide'] === 'true') {
+      return 'cluster-wide';
+    }
+    if (annotations['sealedsecrets.bitnami.com/namespace-wide'] === 'true') {
+      return 'namespace-wide';
+    }
+    return 'strict';
+  }
+
+  /**
+   * Get the count of encrypted keys
+   */
+  get encryptedKeysCount(): number {
+    return Object.keys(this.spec.encryptedData || {}).length;
+  }
+
+  /**
+   * Check if the SealedSecret is synced
+   */
+  get isSynced(): boolean {
+    const syncCondition = this.status?.conditions?.find(c => c.type === 'Synced');
+    return syncCondition?.status === 'True';
+  }
+
+  /**
+   * Get the sync status condition
+   */
+  get syncCondition() {
+    return this.status?.conditions?.find(c => c.type === 'Synced');
+  }
+
+  /**
+   * Get the sync status message
+   */
+  get syncMessage(): string {
+    const condition = this.syncCondition;
+    if (!condition) {
+      return 'Unknown';
+    }
+    return condition.message || condition.reason || condition.status;
+  }
+}
@@ -0,0 +1,126 @@
+/**
+ * Sealed Secrets Controller API helpers
+ *
+ * Utilities for interacting with the sealed-secrets-controller HTTP API
+ * via the Kubernetes API proxy.
+ */
+
+import { request } from '@kinvolk/headlamp-plugin/lib/lib/k8s/apiProxy';
+import { PluginConfig } from '../types';
+
+/**
+ * Build the controller proxy URL
+ */
+export function getControllerProxyURL(config: PluginConfig, path: string): string {
+  const { controllerNamespace, controllerName, controllerPort } = config;
+  return `/api/v1/namespaces/${controllerNamespace}/services/http:${controllerName}:${controllerPort}/proxy${path}`;
+}
+
+/**
+ * Fetch the controller's public certificate
+ *
+ * @param config Plugin configuration
+ * @returns PEM-encoded certificate
+ */
+export async function fetchPublicCertificate(config: PluginConfig): Promise<string> {
+  const url = getControllerProxyURL(config, '/v1/cert.pem');
+
+  try {
+    const response = await fetch(url);
+    if (!response.ok) {
+      throw new Error(`Failed to fetch certificate: ${response.status} ${response.statusText}`);
+    }
+    const cert = await response.text();
+    return cert;
+  } catch (error) {
+    throw new Error(`Unable to fetch controller certificate: ${error}`);
+  }
+}
+
+/**
+ * Verify that a SealedSecret can be decrypted by the controller
+ *
+ * @param config Plugin configuration
+ * @param sealedSecretYaml YAML or JSON of the SealedSecret
+ */
+export async function verifySealedSecret(
+  config: PluginConfig,
+  sealedSecretYaml: string
+): Promise<boolean> {
+  const url = getControllerProxyURL(config, '/v1/verify');
+
+  try {
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: sealedSecretYaml,
+    });
+
+    return response.ok;
+  } catch (error) {
+    console.error('Verification failed:', error);
+    return false;
+  }
+}
+
+/**
+ * Rotate (re-encrypt) a SealedSecret with the current active key
+ *
+ * @param config Plugin configuration
+ * @param sealedSecretYaml YAML or JSON of the SealedSecret
+ * @returns The re-encrypted SealedSecret
+ */
+export async function rotateSealedSecret(
+  config: PluginConfig,
+  sealedSecretYaml: string
+): Promise<string> {
+  const url = getControllerProxyURL(config, '/v1/rotate');
+
+  try {
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: sealedSecretYaml,
+    });
+
+    if (!response.ok) {
+      throw new Error(`Rotation failed: ${response.status} ${response.statusText}`);
+    }
+
+    return await response.text();
+  } catch (error) {
+    throw new Error(`Unable to rotate SealedSecret: ${error}`);
+  }
+}
+
+/**
+ * Get plugin configuration from localStorage
+ */
+export function getPluginConfig(): PluginConfig {
+  const stored = localStorage.getItem('sealed-secrets-plugin-config');
+  if (stored) {
+    try {
+      return JSON.parse(stored);
+    } catch {
+      // Fall through to default
+    }
+  }
+
+  // Return default config
+  return {
+    controllerName: 'sealed-secrets-controller',
+    controllerNamespace: 'kube-system',
+    controllerPort: 8080,
+  };
+}
+
+/**
+ * Save plugin configuration to localStorage
+ */
+export function savePluginConfig(config: PluginConfig): void {
+  localStorage.setItem('sealed-secrets-plugin-config', JSON.stringify(config));
+}
@@ -0,0 +1,137 @@
+/**
+ * Client-side encryption utilities for Sealed Secrets
+ *
+ * This module handles the encryption of secret values using the sealed-secrets
+ * controller's public key. The encryption process matches the kubeseal CLI tool:
+ *
+ * 1. Generate a random AES-256-GCM session key
+ * 2. Encrypt the secret value with the session key
+ * 3. Encrypt the session key with the RSA public key (OAEP + SHA-256)
+ * 4. Construct the payload: 2-byte length prefix + encrypted session key + encrypted data
+ * 5. Base64-encode the result
+ */
+
+import forge from 'node-forge';
+import { SealedSecretScope } from '../types';
+
+/**
+ * Parse a PEM certificate and extract the RSA public key
+ */
+export function parsePublicKeyFromCert(pemCert: string): forge.pki.rsa.PublicKey {
+  try {
+    const cert = forge.pki.certificateFromPem(pemCert);
+    const publicKey = cert.publicKey as forge.pki.rsa.PublicKey;
+    return publicKey;
+  } catch (error) {
+    throw new Error(`Failed to parse certificate: ${error}`);
+  }
+}
+
+/**
+ * Encrypt a secret value using the kubeseal format
+ *
+ * @param publicKey RSA public key from the controller's certificate
+ * @param value The plaintext secret value to encrypt
+ * @param namespace The namespace (for strict/namespace-wide scoping)
+ * @param name The secret name (for strict scoping)
+ * @param key The key name within the secret
+ * @param scope The encryption scope
+ * @returns Base64-encoded encrypted value
+ */
+export function encryptValue(
+  publicKey: forge.pki.rsa.PublicKey,
+  value: string,
+  namespace: string,
+  name: string,
+  key: string,
+  scope: SealedSecretScope
+): string {
+  try {
+    // Generate a random 32-byte (256-bit) AES session key
+    const sessionKey = forge.random.getBytesSync(32);
+
+    // Construct the label for RSA-OAEP based on scope
+    // This binds the encryption to specific namespace/name/key depending on scope
+    let label = '';
+    if (scope === 'strict') {
+      // Strict scope: namespace.name.key
+      label = `${namespace}.${name}.${key}`;
+    } else if (scope === 'namespace-wide') {
+      // Namespace-wide scope: namespace.key
+      label = `${namespace}.${key}`;
+    } else {
+      // Cluster-wide scope: just the key
+      label = key;
+    }
+
+    // Encrypt the session key with RSA-OAEP (SHA-256)
+    const encryptedSessionKey = publicKey.encrypt(sessionKey, 'RSA-OAEP', {
+      md: forge.md.sha256.create(),
+      mgf1: {
+        md: forge.md.sha256.create(),
+      },
+      label: label,
+    });
+
+    // Encrypt the actual secret value with AES-256-GCM
+    const iv = forge.random.getBytesSync(12); // 12 bytes for GCM
+    const cipher = forge.cipher.createCipher('AES-GCM', sessionKey);
+    cipher.start({ iv: iv });
+    cipher.update(forge.util.createBuffer(value, 'utf8'));
+    cipher.finish();
+
+    const encryptedValue = cipher.output.getBytes();
+    const tag = (cipher.mode as any).tag.getBytes();
+
+    // Construct the sealed secret format:
+    // [2-byte length of encrypted session key][encrypted session key][IV][encrypted value][auth tag]
+    const sessionKeyLength = encryptedSessionKey.length;
+    const lengthBytes = String.fromCharCode((sessionKeyLength >> 8) & 0xff) +
+                        String.fromCharCode(sessionKeyLength & 0xff);
+
+    const payload = lengthBytes + encryptedSessionKey + iv + encryptedValue + tag;
+
+    // Base64 encode the final payload
+    return forge.util.encode64(payload);
+  } catch (error) {
+    throw new Error(`Encryption failed: ${error}`);
+  }
+}
+
+/**
+ * Encrypt multiple key-value pairs for a SealedSecret
+ *
+ * @param publicKey RSA public key from the controller's certificate
+ * @param keyValues Array of {key, value} pairs to encrypt
+ * @param namespace The namespace
+ * @param name The secret name
+ * @param scope The encryption scope
+ * @returns Object mapping keys to encrypted values
+ */
+export function encryptKeyValues(
+  publicKey: forge.pki.rsa.PublicKey,
+  keyValues: Array<{ key: string; value: string }>,
+  namespace: string,
+  name: string,
+  scope: SealedSecretScope
+): Record<string, string> {
+  const encryptedData: Record<string, string> = {};
+
+  for (const { key, value } of keyValues) {
+    encryptedData[key] = encryptValue(publicKey, value, namespace, name, key, scope);
+  }
+
+  return encryptedData;
+}
+
+/**
+ * Validate a PEM certificate
+ */
+export function validateCertificate(pemCert: string): boolean {
+  try {
+    parsePublicKeyFromCert(pemCert);
+    return true;
+  } catch {
+    return false;
+  }
+}