From ddfcf6c8466ba41b641e300a5178c64d4cdfd9a3 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 3 Oct 2026 09:17:47 +1000
Subject: [PATCH] add kubectl-view-secret package (#183)

kubectl-view-secret decodes Kubernetes secrets as a kubectl plugin; packaging it puts it on hosts with shell completion of secret names. kubectl maps `view-secret` to an underscored binary name, so files use `view_secret`.

- add kubectl-view-secret 0.16.0 for el9 and fedora 42-44 with checksum verification
- install the plugin as /usr/bin/kubectl-view_secret
- add kubectl_complete-view_secret for kubectl plugin completion
- ship bash/zsh/fish completions renamed to the installed binary

Requires terraform-artifactapi github allowlist entries.

Reviewed-on: https://git.unkin.net/unkin/rpmbuilder/pulls/183
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
---
 rpms/kubectl-view-secret/metadata.yaml        | 22 ++++++++
 rpms/kubectl-view-secret/resources/build.sh   | 24 +++++++++
 .../resources/kubectl_complete-view_secret    |  2 +
 rpms/kubectl-view-secret/resources/nfpm.yaml  | 54 +++++++++++++++++++
 4 files changed, 102 insertions(+)
 create mode 100644 rpms/kubectl-view-secret/metadata.yaml
 create mode 100755 rpms/kubectl-view-secret/resources/build.sh
 create mode 100755 rpms/kubectl-view-secret/resources/kubectl_complete-view_secret
 create mode 100644 rpms/kubectl-view-secret/resources/nfpm.yaml

diff --git a/rpms/kubectl-view-secret/metadata.yaml b/rpms/kubectl-view-secret/metadata.yaml
new file mode 100644
index 0000000..94b7ee9
--- /dev/null
+++ b/rpms/kubectl-view-secret/metadata.yaml
@@ -0,0 +1,22 @@
+name: kubectl-view-secret
+github: elsesiy/kubectl-view-secret
+description: Kubectl plugin to decode Kubernetes secrets.
+arch: amd64
+platform: linux
+maintainer: Jonas-Taha El Sesiy
+homepage: https://github.com/elsesiy/kubectl-view-secret
+license: MIT
+dist_tag: true
+builds:
+- repository:
+  - almalinux/el9
+  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  release: 1
+  version: 0.16.0
+- repository:
+  - fedora/42
+  - fedora/43
+  - fedora/44
+  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  release: 1
+  version: 0.16.0
diff --git a/rpms/kubectl-view-secret/resources/build.sh b/rpms/kubectl-view-secret/resources/build.sh
new file mode 100755
index 0000000..a1ab2cd
--- /dev/null
+++ b/rpms/kubectl-view-secret/resources/build.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/bash
+
+set -e
+
+BASE_URL="https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/elsesiy/kubectl-view-secret/releases/download/v${PACKAGE_VERSION}"
+TARBALL="kubectl-view-secret_v${PACKAGE_VERSION}_linux_amd64.tar.gz"
+
+wget -O "/app/${TARBALL}" "${BASE_URL}/${TARBALL}"
+wget -O /app/checksums.txt "${BASE_URL}/kubectl-view-secret_${PACKAGE_VERSION}_checksums.txt"
+
+cd /app
+grep " ${TARBALL}$" checksums.txt | sha256sum --check --strict -
+tar xf "/app/${TARBALL}" -C /app/ kubectl-view-secret
+
+mkdir -p /app/completions
+# kubectl resolves `kubectl view-secret` to kubectl-view_secret; upstream completions target "view-secret".
+mv /app/kubectl-view-secret /app/kubectl-view_secret
+/app/kubectl-view_secret completion bash | sed 's/view-secret/kubectl-view_secret/g' > /app/completions/kubectl-view_secret
+/app/kubectl-view_secret completion zsh | sed 's/view-secret/kubectl-view_secret/g' > /app/completions/_kubectl-view_secret
+/app/kubectl-view_secret completion fish | sed 's/view-secret/kubectl-view_secret/g' > /app/completions/kubectl-view_secret.fish
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
diff --git a/rpms/kubectl-view-secret/resources/kubectl_complete-view_secret b/rpms/kubectl-view-secret/resources/kubectl_complete-view_secret
new file mode 100755
index 0000000..0f0a097
--- /dev/null
+++ b/rpms/kubectl-view-secret/resources/kubectl_complete-view_secret
@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+exec kubectl view-secret __complete "$@"
diff --git a/rpms/kubectl-view-secret/resources/nfpm.yaml b/rpms/kubectl-view-secret/resources/nfpm.yaml
new file mode 100644
index 0000000..bca0bb5
--- /dev/null
+++ b/rpms/kubectl-view-secret/resources/nfpm.yaml
@@ -0,0 +1,54 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - kubectl-view-secret
+
+provides:
+  - kubectl-view-secret
+
+contents:
+  - src: /app/kubectl-view_secret
+    dst: /usr/bin/kubectl-view_secret
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: /app/resources/kubectl_complete-view_secret
+    dst: /usr/bin/kubectl_complete-view_secret
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: /app/completions/kubectl-view_secret
+    dst: /usr/share/bash-completion/completions/kubectl-view_secret
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+  - src: /app/completions/_kubectl-view_secret
+    dst: /usr/share/zsh/site-functions/_kubectl-view_secret
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+  - src: /app/completions/kubectl-view_secret.fish
+    dst: /usr/share/fish/vendor_completions.d/kubectl-view_secret.fish
+    file_info:
+      mode: 0644
+      owner: root
+      group: root