Read a Secret in plaintext

kubectl returns Secret data base64-encoded, so reading one means a pipe through base64 -d and some jsonpath.

kx secret            # list Secrets, indexed like any other listing
kx secret 1 --decode # keys and values, decoded

Values that aren’t text show as <binary, N bytes> rather than garbling the table with control characters.

One value, raw

kx secret 1 --decode -k password

The -k/--key flag prints a single value with no banner, no table and no trailing newline fuss — so it composes:

export PGPASSWORD=$(kx secret 1 --decode -k password)
kx secret 1 --decode -k tls.crt > tls.crt

That second one is why binary values are supported rather than refused: redirecting to a file is the sensible thing to do with a certificate or a keystore.

The whole namespace

kx secret --decode

decodes every Secret in the namespace in one call. It asks for confirmation first, because that prints every credential in the namespace to your terminal and into your scrollback. The --yes/-y flag skips the prompt, for when you meant it.

Elsewhere

The -n and -A flags work as they do everywhere:

kx secret -n prod
kx secret -A

The kx secrets alias works too, and kx get secrets --decode is the same thing spelled the long way — --decode lives on kx get too.