kubectl: get specific value from a secret in plaintext

Question

I want to get the value of a specific field of a secret in a shell script.

From the kubectl get secret documentation, it seems the standard way to get a secret returns the whole thing, in a specified format, with the values base64 encoded.

So, to get the bar field of the foo secret, output as an unencoded string, I'm doing this:

kubectl get secret foo -o json | jq -r ".data.bar" | base64 --decode

That is

• get the whole foo secret as JSON
• pipe to jq to read the bar field from the JSON
• decode the value using base64

Is there a way to do this only using kubectl?

Or an elegant way in POSIX-compliant shell that doesn't rely on any dependencies like jq?

Answer 1

Try this

kubectl get secret foo --template={{.data.bar}} | base64 --decode

No need of jq.

Answer 2

This should work since Kubernetes 1.11 (see PR 60755):

kubectl get secret foo -o go-template='{{ .data.bar | base64decode }}'