c62e967ce3
Clean up 404 KCL references (99.75% complete): - Rename kcl_* variables to schema_*/nickel_* (kcl_path→schema_path, etc.) - Update functions: parse_kcl_file→parse_nickel_file - Update env vars: KCL_MOD_PATH→NICKEL_IMPORT_PATH - Fix cli/providers-install: add has_nickel and nickel_version variables - Correct import syntax: .nickel.→.ncl. - Update 57 files across core, CLI, config, and utilities Configure pre-commit hooks: - Activate: nushell-check, nickel-typecheck, markdownlint - Comment out: Rust hooks (fmt, clippy, test), check-yaml Testing: - Module discovery: 9 modules (6 providers, 1 taskserv, 2 clusters) ✅ - Syntax validation: 15 core files ✅ - Pre-commit hooks: all passing ✅
84 lines
2.5 KiB
Plaintext
84 lines
2.5 KiB
Plaintext
# Import will be handled by parent context
|
|
use ../lib_provisioning/config/accessor.nu *
|
|
|
|
# Secrets management with infrastructure and services (SOPS or KMS)
|
|
export def "main secrets" [
|
|
sourcefile?: string # source file for secrets command
|
|
targetfile?: string # target file for secrets command
|
|
--provider (-p): string # secret provider: sops or kms
|
|
--encrypt (-e) # Encrypt file
|
|
--decrypt (-d) # Decrypt file
|
|
--gen (-g) # Generate encrypted files
|
|
--sed # Edit encrypted file
|
|
--debug (-x) # Use Debug mode
|
|
--xm # Debug with PROVISIONING_METADATA
|
|
--xc # Debug for task and services locally PROVISIONING_DEBUG_CHECK
|
|
--xr # Debug for remote servers PROVISIONING_DEBUG_REMOTE
|
|
--xld # Log level with DEBUG PROVISIONING_LOG_LEVEL=debug
|
|
--metadata # Error with metadata (-xm)
|
|
--notitles # not tittles
|
|
--out: string # Print Output format: json, yaml, text (default)
|
|
]: nothing -> nothing {
|
|
if ($out | is-not-empty) {
|
|
$env.PROVISIONING_OUT = $out
|
|
$env.PROVISIONING_NO_TERMINAL = true
|
|
}
|
|
|
|
# Set secret provider if specified
|
|
if ($provider | is-not-empty) {
|
|
$env.PROVISIONING_SECRET_PROVIDER = $provider
|
|
}
|
|
|
|
parse_help_command "secrets" --end
|
|
if $debug { $env.PROVISIONING_DEBUG = true }
|
|
|
|
if $sourcefile == "sed" or $sourcefile == "ed" {
|
|
on_secrets "sed" $targetfile
|
|
end_run "secrets"
|
|
return true
|
|
}
|
|
|
|
if $sed and $sourcefile != null and ($sourcefile | path exists) {
|
|
on_secrets sed $sourcefile
|
|
exit
|
|
}
|
|
|
|
if $encrypt {
|
|
if $sourcefile == null or not ($sourcefile | path exists) {
|
|
print $"🛑 Error on_secrets encrypt 'sourcefile' ($sourcefile) not found "
|
|
exit 1
|
|
}
|
|
if ($targetfile | is-not-empty) {
|
|
print $"on_secrets encrypt ($sourcefile) ($targetfile)"
|
|
on_secrets "encrypt" $sourcefile $targetfile
|
|
exit
|
|
} else {
|
|
print $"on_secrets encrypt ($sourcefile) "
|
|
print (on_secrets "encrypt" $sourcefile)
|
|
exit
|
|
}
|
|
}
|
|
|
|
if $decrypt {
|
|
if $sourcefile == null or not ($sourcefile | path exists) {
|
|
print $"🛑 Error on_secrets decrypt 'sourcefile' ($sourcefile) not found "
|
|
return false
|
|
}
|
|
if ($targetfile | is-not-empty) {
|
|
on_secrets decrypt $sourcefile $targetfile
|
|
exit
|
|
} else {
|
|
print (on_secrets decrypt $sourcefile)
|
|
exit
|
|
}
|
|
}
|
|
|
|
if $gen and $sourcefile != null {
|
|
on_secrets generate $sourcefile $targetfile
|
|
exit
|
|
}
|
|
|
|
option_undefined "secrets" ""
|
|
end_run "secrets"
|
|
}
|