{"id":13522143,"url":"https://github.com/pr8kerl/kubectl-ssm-secret","last_synced_at":"2026-01-24T07:51:35.851Z","repository":{"id":42697596,"uuid":"196567734","full_name":"pr8kerl/kubectl-ssm-secret","owner":"pr8kerl","description":null,"archived":false,"fork":false,"pushed_at":"2023-10-11T23:26:02.000Z","size":173,"stargazers_count":26,"open_issues_count":1,"forks_count":5,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-11-02T06:31:40.909Z","etag":null,"topics":["eks","kubectl-plugins","kubernetes","parameter-store","secrets","ssm"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pr8kerl.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-07-12T11:28:09.000Z","updated_at":"2024-10-18T18:16:48.000Z","dependencies_parsed_at":"2024-01-13T22:45:45.549Z","dependency_job_id":null,"html_url":"https://github.com/pr8kerl/kubectl-ssm-secret","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pr8kerl%2Fkubectl-ssm-secret","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pr8kerl%2Fkubectl-ssm-secret/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pr8kerl%2Fkubectl-ssm-secret/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pr8kerl%2Fkubectl-ssm-secret/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pr8kerl","download_url":"https://codeload.github.com/pr8kerl/kubectl-ssm-secret/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246552067,"owners_count":20795758,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["eks","kubectl-plugins","kubernetes","parameter-store","secrets","ssm"],"created_at":"2024-08-01T06:00:42.872Z","updated_at":"2026-01-24T07:51:30.819Z","avatar_url":"https://github.com/pr8kerl.png","language":"Go","funding_links":[],"categories":["Go","kubectl Plugins"],"sub_categories":["Installing plugins via awesome-kubectl-plugins"],"readme":"# kubectl-ssm-secret\n\nA kubectl plugin to allow import/export of kubernetes secrets to/from AWS SSM Parameter Store path.\n\nThe plugin is opinionated. It will look for parameters under a single path. It will not recursively search more than one level under a given path. All parameters found under the given parameter store path can be imported into a single kubernetes secret as StringData.\n\nUseful if you are reprovisioning clusters or namespaces and need to provision the same secrets over and over.\nOr perhaps useful to backup/restore your LetsEncrypt or other certificates.\n \n## examples\n\nGiven a couple of parameters stored in param store under the path `/foo`, these can easily be imported into kubernetes into a single secret.\n\nIf an AWS parameter at path `/foo/bar` contains a secret value, and the parameter `/foo/passwd` contains a secure password, we can view the keys and values in parameter store using the `kubectl ssm-secret list` subcommand:\n\n```\n% kubectl ssm-secret list --ssm-path /foo\nssm:/foo/bar: foobar\nssm:/foo/passwd: SuperSecretSquirrelPassword\n```\n\nThese params can then be imported with the following import command:\n```\n% kubectl ssm-secret import foo --ssm-path /foo\nimported secret: foo\n```\n\nThe resulting kubernetes secret created will look like this:\n```\n% kubectl get secret foo -o yaml\napiVersion: v1\ndata:\n  bar: Zm9vYmFy\n  passwd: U3VwZXJTZWNyZXRTcXVpcnJlbFBhc3N3b3Jk\nkind: Secret\nmetadata:\n  creationTimestamp: \"2019-08-10T00:42:35Z\"\n  name: foo\n  namespace: default\n  resourceVersion: \"5565641\"\n  selfLink: /api/v1/namespaces/default/secrets/foo\n  uid: bf0fe887-bb07-11e9-9531-02946becbcee\ntype: Opaque\n```\n\nssm-secret can also be used to then view the plain-text contents of the kubernetes secret using list subcommand:\n```\n% kubectl ssm-secret list foo\nk8s:default/foo/bar: foobar\nk8s:default/foo/passwd: SuperSecretSquirrelPassword\n```\n\nAdditionally, we can export a secret from kubernetes into a parameter store path:\n```\n% kubectl ssm-secret export foo --ssm-path /bar\ncreated parameter: /bar/bar, version: 1\ncreated parameter: /bar/passwd, version: 1\nexported secret: foo\n```\n\n## Install\n\nUse latest [krew](https://github.com/kubernetes-sigs/krew) to install.\n\n```\n% kubectl krew install ssm-secret\n```\n\n## Build \n\nRequires docker and docker-compose installed locally.\n\n* clone the repository\n* set your `GOOS` environment variable to match your platform\n\n```\n% git clone git@github.com:pr8kerl/kubectl-ssm-secret.git\n% cd kubectl-ssm-secret\n% GOOS=darwin GOARCH=arm64 docker-compose run --rm make\n```\n\n## Use\n\n* Authenticate to AWS\n* Authenticate to your kubernetes cluster\n* Use the `list` subcommand to list keys and decoded values from a kubernetes secret or from a ssm parameter store path\n* Use the `import` subcommand to create a kubernetes secret from key/values stored under a parameter store path\n* Use the `export` subcommand to copy from a kubernetes secret to a parameter store path\n* Use the `--overwrite` flag to overwrite an existing kubernetes secret or existing parameter store keys.\n* Use the `--advanced` flag to export a kubernetes secret which size is over 4 KB to an advanced parameter.\n* Use the `--tls` flag with the import subcommand to create a kubernetes tls secret instead of the default opaque type\n* Use the `--namespace` flag to to override the kubernetes namespace in the current context\n\n```\n% kubectl ssm-secret --help\nview or import/export k8s secrets from/to aws ssm param store\n\nUsage:\n  ssm-secret list|import|export secret [flags]\n  ssm-secret [command]\n\nExamples:\n\n        # view the parameter store keys and values located in parameter store path /param/path/foo\n        kubectl ssm-secret list --ssm-path /param/path/foo\n\n        # view the kubernetes secret called foo\n        kubectl ssm-secret list foo\n\n        # import to a kubernetes secret called foo from key/values stored at parameter store path /param/path/foo\n        kubectl ssm-secret import foo --ssm-path /param/path/foo\n\n        # export a kubernetes secret called foo to aws ssm parameter store path /param/path/foo\n        kubectl ssm-secret export foo --ssm-path /param/path/foo\n\n        # display the plugin version\n        kubectl ssm-secret version\n\n\nAvailable Commands:\n  export      export a kubernetes secret to aws ssm param store\n  help        Help about any command\n  import      import a kubernetes secret from aws ssm param store\n  list        list ssm parameters by path \n  version     print the ssm-secret version\n\nFlags:\n  -h, --help               help for ssm-secret\n  -n, --namespace string   kubernetes namespace (default \"default\")\n\nUse \"ssm-secret [command] --help\" for more information about a command.\n```\n\n```\n% kubectl ssm-secret export --help\nexport a kubernetes secret to aws ssm param store\n\nUsage:\n  ssm-secret export [flags]\n\nFlags:\n  -e, --encode            gzip, base64 encode values in parameter store\n  -h, --help              help for export\n  -o, --overwrite         if parameter store key exists, overwite its values with those from k8s secret\n  -a, --advanced          if secret size is over 4 KB, store it in an advanced parameter\n  -s, --ssm-path string   ssm parameter store path to write data to\n\nGlobal Flags:\n  -n, --namespace string   kubernetes namespace (default \"default\")\n```\n\n```\n% kubectl ssm-secret import --help\nimport a kubernetes secret from aws ssm param store\n\nUsage:\n  ssm-secret import [flags]\n\nFlags:\n  -d, --decode            treat store values in param store as gzipped, base64 encoded strings\n  -h, --help              help for import\n  -o, --overwrite         if k8s secret exists, overwite its values with those from param store\n  -s, --ssm-path string   ssm parameter store path to read data from\n  -t, --tls               import ssm param store values to k8s tls secret\n\nGlobal Flags:\n  -n, --namespace string   kubernetes namespace (default \"default\")\n```\n\n```\n% kubectl ssm-secret list --help\nFlags:\n  -e, --env               output as environment variable key pairs\n  -h, --help              help for list\n  -s, --ssm-path string   ssm parameter store path to list parameters from\n\nGlobal Flags:\n  -n, --namespace string   kubernetes namespace (default \"svcs\")\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpr8kerl%2Fkubectl-ssm-secret","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpr8kerl%2Fkubectl-ssm-secret","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpr8kerl%2Fkubectl-ssm-secret/lists"}