Hi, I have no idea how difficult it is to implement but it would be

Hi, I created a little workaround for this. I wrote a <code clas

Feature Request: encrypt a file partially only about transcrypt HOT 2 CLOSED

steled commented on August 28, 2024

Feature Request: encrypt a file partially only

from transcrypt.

Comments (2)

jmurty commented on August 28, 2024

Hi, that would be a cool feature but it's not something we will do sorry. It would be very difficult to do, if it's possible at all, so it's not something we will support.

from transcrypt.

steled commented on August 28, 2024

Hi,

I created a little workaround for this.
I wrote a pre-commit-githook that uses sed to create an partially encrypted *.dec file of the fully encrypted file.

#!/usr/bin/env bash
# sed pre-commit hook: duplicate decrypted sensitive file and redact sensitive informations via sed

tmp=$(mktemp)
IFS=$'\n'
for secret_file in $(git -c core.quotePath=false ls-files | git -c core.quotePath=false check-attr --stdin filter | awk 'BEGIN { FS = ":" }; /crypt$/{ print $1 }'); do
    # Skip symlinks, they contain the linked target file path not plaintext
    if [[ -L $secret_file ]]; then
        continue
    fi

    # extract filename
    filename="${secret_file##*/}"
    # get file extension
    file_extension="${filename##*.}"
    # get filename without extension
    file="${filename%.*}"
    # extract directory
    dir="$(dirname ${secret_file})"

    # if test -f "${dir}/${file}.sed"; then
    if test -f "${dir}/${filename}.sed"; then
        if [ $file_extension == $file ]; then
            sed -f "${dir}/${filename}.sed" $secret_file > "${dir}/${file}_dec"
        else
            sed -f "${dir}/${filename}.sed" $secret_file > "${dir}/${file}.${file_extension}.dec"
        fi
    fi

done
rm -f "${tmp}"
unset IFS

You than just need to create a sed file where you define what should be replaced and the hook than creates with this sed file an *.dec file.

Example

plain file aws-etcd-backup.yaml

apiVersion: v1
kind: Secret
metadata:
  name: dgops-s3-credentials
  namespace: kube-system
type: Opaque
data:
  ACCESS_KEY_ID: TEST_KEY_ID
  SECRET_ACCESS_KEY: TEST_ACCESS_KEY

sed file aws-etcd-backup.yaml.sed

s/\(ACCESS_KEY_ID: \).*/\1<REDACTED>/
s/\(SECRET_ACCESS_KEY: \).*/\1<REDACTED>/

resulting partially decrypted file aws-etcd-backup.yaml.dec

apiVersion: v1
kind: Secret
metadata:
  name: dgops-s3-credentials
  namespace: kube-system
type: Opaque
data:
  ACCESS_KEY_ID: <REDACTED>
  SECRET_ACCESS_KEY: <REDACTED>