## Verify kubectl is configured and the cluster is reachable
kubectl cluster-info

## Verify you can list namespaces
kubectl get namespaces

## Create the secrets-lab namespace from the manifest file
kubectl apply -f manifests/namespace.yaml

## Verify the namespace was created
kubectl get namespace secrets-lab

## Set the default namespace for this lab session so we don't need
## to add -n secrets-lab to every command
kubectl config set-context --current --namespace=secrets-lab

## Create an Opaque Secret with literal key-value pairs
## The --from-literal flag accepts key=value pairs
kubectl create secret generic db-credentials \
  --from-literal=username=admin \
  --from-literal=password='S3cur3P@ssw0rd!' \
  --from-literal=host=db.example.com \
  --from-literal=port=5432

## Verify the Secret was created
kubectl get secret db-credentials

## View the Secret details (values are base64-encoded)
kubectl get secret db-credentials -o yaml

## Create sample credential files
echo -n "admin" > /tmp/username.txt
echo -n "S3cur3P@ssw0rd!" > /tmp/password.txt

## Create a Secret from files
## Each file becomes a key (filename) with the file contents as the value
kubectl create secret generic file-credentials \
  --from-file=/tmp/username.txt \
  --from-file=/tmp/password.txt

## Verify the Secret was created
kubectl get secret file-credentials -o yaml

## You can also specify a custom key name using key=path syntax
kubectl create secret generic file-credentials-custom \
  --from-file=db-user=/tmp/username.txt \
  --from-file=db-pass=/tmp/password.txt

## Verify the custom key names
kubectl get secret file-credentials-custom -o jsonpath='{.data}' | python3 -m json.tool

## Clean up temporary files
rm /tmp/username.txt /tmp/password.txt

## Create an env file with key=value pairs (one per line)
cat <<'EOF' > /tmp/app-secrets.env
DB_HOST=db.example.com
DB_PORT=5432
DB_USER=admin
DB_PASSWORD=S3cur3P@ssw0rd!
API_KEY=sk-1234567890abcdef
EOF

## Create a Secret from the env file
## Each line becomes a separate key-value pair in the Secret
kubectl create secret generic env-credentials \
  --from-env-file=/tmp/app-secrets.env

## Verify the Secret keys match the env file entries
kubectl get secret env-credentials -o jsonpath='{.data}' | python3 -m json.tool

## Clean up
rm /tmp/app-secrets.env

## List all Secrets in the namespace
kubectl get secrets

## Describe a Secret to see metadata (values are hidden)
kubectl describe secret db-credentials

## Decode a specific value from a Secret
kubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 --decode
echo  ## Add a newline for readability

## Decode ALL values from a Secret using a one-liner
kubectl get secret db-credentials -o json | \
  python3 -c "import json,sys,base64; \
  data=json.load(sys.stdin)['data']; \
  [print(f'{k}: {base64.b64decode(v).decode()}') for k,v in data.items()]"

## Apply the Opaque Secret manifest that uses stringData
kubectl apply -f manifests/secret-opaque.yaml

## Verify the Secret was created
kubectl get secret app-credentials

## View the Secret -- notice that stringData values are now base64-encoded
## under the 'data' field (stringData is a write-only convenience field)
kubectl get secret app-credentials -o yaml

## When using the 'data' field, you must base64-encode values yourself
## Encode a value to base64
echo -n "my-secret-value" | base64
## Output: bXktc2VjcmV0LXZhbHVl

## Decode a base64 value back to plain text
echo "bXktc2VjcmV0LXZhbHVl" | base64 --decode
## Output: my-secret-value

## Retrieve the Secret and decode the username
kubectl get secret app-credentials -o jsonpath='{.data.username}' | base64 --decode
echo  ## Newline
## Output: admin

## Retrieve and decode the password
kubectl get secret app-credentials -o jsonpath='{.data.password}' | base64 --decode
echo  ## Newline
## Output: S3cur3P@ssw0rd!

## Retrieve and decode the database URL
kubectl get secret app-credentials -o jsonpath='{.data.database-url}' | base64 --decode
echo  ## Newline
## Output: postgres://admin:S3cur3P%40ssw0rd!@db-host:5432/mydb

## Ensure the app-credentials Secret exists (from Step 03)
kubectl get secret app-credentials

## Apply the Pod that mounts Secret values as environment variables
kubectl apply -f manifests/pod-env-secret.yaml

## Wait for the Pod to be running
kubectl wait --for=condition=Ready pod/secret-env-demo --timeout=60s

## View the Pod logs to see the environment variables in action
kubectl logs secret-env-demo

## You can also exec into the Pod and inspect the environment
kubectl exec secret-env-demo -- env | grep -E "DB_|DATABASE_"

## Verify a specific variable
kubectl exec secret-env-demo -- sh -c 'echo $DB_USERNAME'

## Create a Pod that loads all Secret keys as env vars using envFrom
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: secret-envfrom-demo
  namespace: secrets-lab
spec:
  containers:
    - name: demo
      image: busybox:1.36
      command: ["sh", "-c", "env | sort | grep -v PATH && sleep 3600"]
      envFrom:
        - secretRef:
            name: db-credentials
          ## Optional: add a prefix to all env var names
          prefix: SECRET_
  restartPolicy: Never
EOF

## Wait for the Pod and check the environment variables
kubectl wait --for=condition=Ready pod/secret-envfrom-demo --timeout=60s
kubectl logs secret-envfrom-demo | grep SECRET_

## Ensure the app-credentials Secret exists
kubectl get secret app-credentials

## Apply the Pod that mounts Secret as a volume
kubectl apply -f manifests/pod-volume-secret.yaml

## Wait for the Pod to be running
kubectl wait --for=condition=Ready pod/secret-volume-demo --timeout=60s

## View the Pod logs to see the mounted files
kubectl logs secret-volume-demo

## Exec into the Pod and read individual Secret files
kubectl exec secret-volume-demo -- cat /etc/secrets/username
kubectl exec secret-volume-demo -- cat /etc/secrets/password

## Verify file permissions (should be 0400 as set in the manifest)
kubectl exec secret-volume-demo -- ls -la /etc/secrets/

## Verify the mount is tmpfs (in-memory filesystem)
kubectl exec secret-volume-demo -- df -T /etc/secrets/

## Create a Pod that mounts only the password key with a custom filename
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: secret-selective-mount
  namespace: secrets-lab
spec:
  containers:
    - name: demo
      image: busybox:1.36
      command: ["sh", "-c", "ls -la /etc/secrets/ && cat /etc/secrets/db-password && sleep 3600"]
      volumeMounts:
        - name: secret-vol
          mountPath: /etc/secrets
          readOnly: true
  volumes:
    - name: secret-vol
      secret:
        secretName: app-credentials
        items:
          ## Only mount the 'password' key, renaming the file to 'db-password'
          - key: password
            path: db-password
            mode: 0400
  restartPolicy: Never
EOF

## Wait and verify
kubectl wait --for=condition=Ready pod/secret-selective-mount --timeout=60s
kubectl logs secret-selective-mount

## Create a docker-registry Secret
## Replace the placeholder values with your actual registry credentials
kubectl create secret docker-registry my-registry-secret \
  --docker-server=https://index.docker.io/v1/ \
  --docker-username=your-username \
  --docker-password=your-password \
  --docker-email=your-email@example.com

## View the created Secret
kubectl get secret my-registry-secret -o yaml

## The Secret contains a .dockerconfigjson key with the registry auth data
## Decode it to see the structure
kubectl get secret my-registry-secret \
  -o jsonpath='{.data.\.dockerconfigjson}' | base64 --decode | python3 -m json.tool

## Create a Pod that references the registry Secret for image pulling
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: private-image-pod
  namespace: secrets-lab
spec:
  containers:
    - name: app
      image: your-registry.example.com/your-app:latest
      ports:
        - containerPort: 8080
  imagePullSecrets:
    - name: my-registry-secret
  restartPolicy: Never
EOF

## Create a ServiceAccount with the imagePullSecret attached
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: private-registry-sa
  namespace: secrets-lab
imagePullSecrets:
  - name: my-registry-secret
EOF

## Any Pod using this ServiceAccount will automatically pull from the private registry
## kubectl get serviceaccount private-registry-sa -o yaml

## Generate a self-signed TLS certificate and private key using openssl
## This creates a certificate valid for 365 days for localhost
openssl req -x509 \
  -nodes \
  -days 365 \
  -newkey rsa:2048 \
  -keyout /tmp/tls.key \
  -out /tmp/tls.crt \
  -subj "/CN=localhost/O=secrets-lab"

## Verify the certificate details
openssl x509 -in /tmp/tls.crt -text -noout | head -20

## Create a TLS Secret from the certificate and key files
## kubectl validates that the cert and key are valid and match
kubectl create secret tls tls-secret \
  --cert=/tmp/tls.crt \
  --key=/tmp/tls.key

## Verify the Secret was created with the correct type
kubectl get secret tls-secret
## The TYPE column should show kubernetes.io/tls

## View the Secret structure
kubectl get secret tls-secret -o yaml
## It contains two keys: tls.crt and tls.key

## Clean up local files
rm /tmp/tls.crt /tmp/tls.key

## Apply the nginx TLS pod and its ConfigMap
kubectl apply -f manifests/tls-pod.yaml

## Wait for the Pod to be running
kubectl wait --for=condition=Ready pod/nginx-tls-demo --timeout=60s

## Test the HTTPS endpoint from inside the cluster
## The -k flag tells curl to accept the self-signed certificate
kubectl exec nginx-tls-demo -- curl -k https://localhost:443 2>/dev/null
## Output: TLS is working! Served by nginx with a self-signed certificate.

## Verify the certificate details served by nginx
kubectl exec nginx-tls-demo -- \
  sh -c "echo | openssl s_client -connect localhost:443 2>/dev/null | openssl x509 -noout -subject -dates"

## Apply the projected volume demo (includes both a ConfigMap and a Pod)
kubectl apply -f manifests/pod-projected-volume.yaml

## Wait for the Pod to be running
kubectl wait --for=condition=Ready pod/projected-volume-demo --timeout=60s

## View the Pod logs to see all projected files
kubectl logs projected-volume-demo

## Exec into the Pod and explore the projected mount
kubectl exec projected-volume-demo -- ls -la /etc/app-config/

## Read a specific file
kubectl exec projected-volume-demo -- cat /etc/app-config/app.properties

## Apply the immutable Secret
kubectl apply -f manifests/immutable-secret.yaml

## Verify it was created
kubectl get secret immutable-api-key
kubectl get secret immutable-api-key -o jsonpath='{.immutable}'
echo  ## Newline
## Output: true

## Try to update the immutable Secret -- this will FAIL
kubectl patch secret immutable-api-key \
  --type='json' \
  -p='[{"op": "replace", "path": "/data/api-key", "value": "bmV3LWtleQ=="}]'

## Expected error:
## Error from server (Forbidden): secrets "immutable-api-key" is forbidden:
## field is immutable when `immutable` is set

## Also try editing -- this will also fail on save
## kubectl edit secret immutable-api-key
## (Uncomment and try if you want to see the error)

## The ONLY way to change an immutable Secret is to delete and recreate it
kubectl delete secret immutable-api-key
kubectl apply -f manifests/immutable-secret.yaml

## Update the db-credentials Secret with a new password
kubectl create secret generic db-credentials \
  --from-literal=username=admin \
  --from-literal=password='N3wR0t@tedP@ss!' \
  --from-literal=host=db.example.com \
  --from-literal=port=5432 \
  --dry-run=client -o yaml | kubectl apply -f -

## Verify the password was updated
kubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 --decode
echo  ## Newline
## Output: N3wR0t@tedP@ss!

## If you still have the secret-volume-demo Pod running from Step 05,
## check that the mounted files reflect the new Secret data.
## (There may be a delay of up to the kubelet sync period, typically 1-2 minutes)

## Wait a moment for the kubelet to sync
sleep 120

## Check the updated file content
kubectl exec secret-volume-demo -- cat /etc/secrets/password 2>/dev/null || \
  echo "Pod secret-volume-demo is not running. Recreate it to test volume auto-update."

## Strategy 1: kubectl rollout restart (simplest, requires Deployment/StatefulSet)
## Create a sample Deployment first
cat <<'EOF' | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: secret-consumer
  namespace: secrets-lab
spec:
  replicas: 2
  selector:
    matchLabels:
      app: secret-consumer
  template:
    metadata:
      labels:
        app: secret-consumer
    spec:
      containers:
        - name: app
          image: busybox:1.36
          command: ["sh", "-c", "while true; do echo DB_PASSWORD=$DB_PASSWORD; sleep 30; done"]
          env:
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: db-credentials
                  key: password
EOF

## Wait for the Deployment to be ready
kubectl rollout status deployment/secret-consumer --timeout=60s

## Now trigger a rolling restart to pick up the updated Secret
kubectl rollout restart deployment/secret-consumer

## Wait for the rollout to complete
kubectl rollout status deployment/secret-consumer --timeout=60s

## Verify the new pods have the updated password
kubectl logs deployment/secret-consumer | head -5

## Strategy 2: Annotation-based trigger (useful in Helm/GitOps workflows)
## Add a hash of the Secret data as a pod annotation.
## When the Secret changes, the annotation changes, triggering a rollout.
SECRET_HASH=$(kubectl get secret db-credentials -o jsonpath='{.data}' | sha256sum | cut -d' ' -f1)

kubectl patch deployment secret-consumer \
  -p "{\"spec\":{\"template\":{\"metadata\":{\"annotations\":{\"secret-hash\":\"$SECRET_HASH\"}}}}}"

## Verify the annotation was added
kubectl get deployment secret-consumer -o jsonpath='{.spec.template.metadata.annotations}' | python3 -m json.tool

## Strategy 3: Automated rotation script
## This script updates a Secret and triggers a rolling restart

cat <<'SCRIPT'
#!/bin/bash
## rotate-secret.sh - Rotate a Secret and restart the consuming Deployment

SECRET_NAME="${1:?Usage: rotate-secret.sh <secret-name> <deployment-name>}"
DEPLOYMENT_NAME="${2:?Usage: rotate-secret.sh <secret-name> <deployment-name>}"
NAMESPACE="${3:-secrets-lab}"

## Generate a new password
NEW_PASSWORD=$(openssl rand -base64 24)

## Update the Secret
kubectl create secret generic "$SECRET_NAME" \
  --from-literal=username=admin \
  --from-literal=password="$NEW_PASSWORD" \
  --from-literal=host=db.example.com \
  --from-literal=port=5432 \
  --namespace="$NAMESPACE" \
  --dry-run=client -o yaml | kubectl apply -f -

echo "Secret '$SECRET_NAME' updated with new password."

## Trigger rolling restart
kubectl rollout restart deployment/"$DEPLOYMENT_NAME" -n "$NAMESPACE"
echo "Rolling restart triggered for deployment '$DEPLOYMENT_NAME'."

## Wait for rollout
kubectl rollout status deployment/"$DEPLOYMENT_NAME" -n "$NAMESPACE" --timeout=120s
echo "Rotation complete."
SCRIPT

## View the example EncryptionConfiguration
cat manifests/encryption-config.yaml

## Generate a random 32-byte encryption key and base64-encode it
head -c 32 /dev/urandom | base64
## Use this output as the 'secret' value in the EncryptionConfiguration

## 1. Copy the EncryptionConfiguration to the control-plane node
## (Replace the key in the file with your generated key first!)
## sudo cp encryption-config.yaml /etc/kubernetes/encryption-config.yaml

## 2. Edit the kube-apiserver manifest to add the encryption flag
## sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
## Add under spec.containers.command:
##   - --encryption-provider-config=/etc/kubernetes/encryption-config.yaml
## Add under spec.containers.volumeMounts:
##   - name: encryption-config
##     mountPath: /etc/kubernetes/encryption-config.yaml
##     readOnly: true
## Add under spec.volumes:
##   - name: encryption-config
##     hostPath:
##       path: /etc/kubernetes/encryption-config.yaml
##       type: File

## 3. The kube-apiserver will restart automatically (it's a static Pod)
## Wait for it to come back up
## kubectl get pods -n kube-system -l component=kube-apiserver

## 4. Re-encrypt all existing Secrets so they are stored encrypted
## kubectl get secrets --all-namespaces -o json | kubectl replace -f -

## 5. Verify encryption is working by checking etcd directly
## ETCDCTL_API=3 etcdctl get /registry/secrets/default/my-secret \
##   --cacert=/etc/kubernetes/pki/etcd/ca.crt \
##   --cert=/etc/kubernetes/pki/etcd/server.crt \
##   --key=/etc/kubernetes/pki/etcd/server.key
## The output should show encrypted (non-readable) data prefixed with "k8s:enc:aescbc:v1:key1"

## Delete the entire namespace (this removes ALL resources within it)
kubectl delete namespace secrets-lab

## Switch back to the default namespace
kubectl config set-context --current --namespace=default

## Clean up any leftover temporary files
rm -f /tmp/username.txt /tmp/password.txt /tmp/app-secrets.env
rm -f /tmp/tls.crt /tmp/tls.key
rm -f /tmp/exercise-tls.crt /tmp/exercise-tls.key
rm -f /tmp/special-chars.txt

## List Secrets in the current namespace
kubectl get secrets -n secrets-lab

## Check if you are in the right namespace
kubectl config view --minify -o jsonpath='{.contexts[0].context.namespace}'

## Correct: no trailing newline
echo -n "myvalue" | base64

## Incorrect: includes trailing newline (will cause issues)
echo "myvalue" | base64

## Verify the Secret exists
kubectl get secret <secret-name> -n secrets-lab

## Check Pod events for errors
kubectl describe pod <pod-name> -n secrets-lab | grep -A10 "Events:"

## Common error: "secret not found" -- verify the name matches exactly
kubectl get pod <pod-name> -n secrets-lab -o yaml | grep secretName

## Check kubelet sync period (on the node)
## Default is --sync-frequency=1m

## IMPORTANT: subPath volume mounts do NOT receive automatic updates
## Avoid using subPath with Secrets if you need auto-rotation

## Delete the immutable Secret
kubectl delete secret <secret-name> -n secrets-lab

## Recreate it with updated values
kubectl apply -f <manifest.yaml>

## Verify the certificate
openssl x509 -in /tmp/tls.crt -text -noout

## Verify the key
openssl rsa -in /tmp/tls.key -check

## Verify the cert and key match (modulus should be identical)
openssl x509 -noout -modulus -in /tmp/tls.crt | openssl md5
openssl rsa -noout -modulus -in /tmp/tls.key | openssl md5

## The Secret type must be kubernetes.io/dockerconfigjson
kubectl get secret <secret-name> -o jsonpath='{.type}'

## Decode and verify the registry URL matches your image registry
kubectl get secret <secret-name> -o jsonpath='{.data.\.dockerconfigjson}' | base64 --decode | python3 -m json.tool