Python script to convert a Kubernetes secret file containing base64-encoded "data" entries to plain text "stringData" entries.

k8s_decode_secret.py

#!/usr/bin/env python3

from base64 import b64decode
import os
import sys
import yaml

if os.isatty(sys.stdin.fileno()):
    print("Usage: ./decode_secret.py < secret.yaml", file=sys.stderr)
    sys.exit(1)

# Parse manifest YAML
manifest = yaml.safe_load(sys.stdin)
if manifest.get("stringData") is None:
    manifest["stringData"] = {}

# Move values from data to stringData.
new_data = dict(manifest["data"])
for (key, value_b64) in manifest["data"].items():
    value_bytes = b64decode(value_b64)
    try:
        value = value_bytes.decode("utf-8")
    except ValueError:
        continue
    del new_data[key]
    manifest["stringData"][key] = value

manifest["data"] = new_data

# Dump new YAML
yaml.safe_dump(manifest, stream=sys.stdout)