new kmeshctl secret command by zrggw · Pull Request #1495 · kmesh-net/kmesh

zrggw · 2025-09-01T10:52:30Z

What type of PR is this?
/kind enhancement

What this PR does / why we need it:
This PR introduces a new kmeshctl secret command that provides comprehensive management of IPsec encryption keys for Kmesh's secure communication between nodes. The command enables users to create, retrieve, and delete IPsec secrets stored as Kubernetes secrets.

Command Structure

kmeshctl secret create [--key=<string>]  # Create/update IPsec secret
kmeshctl secret get                          # Display current IPsec configuration  
kmeshctl secret delete                       # Remove IPsec secret

Documentation
kmeshctl_secret.md - Main command overview
kmeshctl_secret_create.md - Create command details
kmeshctl_secret_get.md - Get command details
kmeshctl_secret_delete.md - Delete command details

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Signed-off-by: aicee <hhbin2000@foxmail.com>

gemini-code-assist

Summary of Changes

Hello @zrggw, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances Kmesh's command-line interface by providing a dedicated and comprehensive tool for managing IPsec encryption keys. This new functionality streamlines the process of securing inter-node communication within Kmesh deployments, offering users direct control over the lifecycle of these critical security assets.

Highlights

New kmeshctl secret command: Introduces a new top-level command kmeshctl secret to manage IPsec encryption keys for Kmesh's secure communication.
Comprehensive IPsec Secret Management: The kmeshctl secret command now includes create, get, and delete subcommands, allowing users to fully manage IPsec secrets stored as Kubernetes secrets.
Flexible Key Creation: The create subcommand supports generating cryptographically secure random keys automatically or accepting a user-defined hexadecimal key string.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Keys in secret kept,Network whispers, safe and sound,Kmesh guards the way.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a new kmeshctl secret command with create, get, and delete subcommands to manage IPsec secrets. The implementation is well-structured, using cobra for the CLI and interacting with the Kubernetes API to manage secrets. The documentation has also been updated accordingly. My review focuses on improving context handling in Kubernetes API calls. I've identified several places where context.TODO() is used, and I recommend replacing it with the command's context (cmd.Context()) for proper cancellation and timeout handling. This is important for making the CLI tool more robust and well-behaved.

gemini-code-assist · 2025-09-01T10:54:14Z

ctl/secret/secret.go

+
 	ipSecKey.Length = AeadAlgoICVLength

 	secretOld, err := clientset.Kube().CoreV1().Secrets(utils.KmeshNamespace).Get(context.TODO(), SecretName, metav1.GetOptions{})


Using context.TODO() is not recommended as it provides an empty, non-cancellable context. Since this function already receives the cmd object from cobra, you should use cmd.Context() for all Kubernetes API calls. This allows for proper cancellation (e.g., if the user presses Ctrl+C) and timeout handling. This change should be applied to all Kubernetes client calls in this function (lines 151, 184, and 190).

Suggested change

secretOld, err := clientset.Kube().CoreV1().Secrets(utils.KmeshNamespace).Get(context.TODO(), SecretName, metav1.GetOptions{})

secretOld, err := clientset.Kube().CoreV1().Secrets(utils.KmeshNamespace).Get(cmd.Context(), SecretName, metav1.GetOptions{})

gemini-code-assist · 2025-09-01T10:54:14Z

ctl/secret/secret.go

+func GetSecret() {
+	clientset := createKubeClientOrExit()
+
+	secret, err := clientset.Kube().CoreV1().Secrets(utils.KmeshNamespace).Get(context.TODO(), SecretName, metav1.GetOptions{})


The GetSecret function uses context.TODO() for its Kubernetes API call. To enable proper context propagation and cancellation, the function should accept the command's context. You should change the function signature to func GetSecret(cmd *cobra.Command) and use cmd.Context(). You will also need to update the call to this function in the getCmd definition (line 85) to pass cmd.

Suggested change

func GetSecret() {

clientset := createKubeClientOrExit()

secret, err := clientset.Kube().CoreV1().Secrets(utils.KmeshNamespace).Get(context.TODO(), SecretName, metav1.GetOptions{})

func GetSecret(cmd *cobra.Command) {

clientset := createKubeClientOrExit()

secret, err := clientset.Kube().CoreV1().Secrets(utils.KmeshNamespace).Get(cmd.Context(), SecretName, metav1.GetOptions{})

gemini-code-assist · 2025-09-01T10:54:14Z

ctl/secret/secret.go

+func DeleteSecret() {
+	clientset := createKubeClientOrExit()
+
+	err := clientset.Kube().CoreV1().Secrets(utils.KmeshNamespace).Delete(context.TODO(), SecretName, metav1.DeleteOptions{})


Similar to GetSecret, the DeleteSecret function uses context.TODO(). It should be updated to accept the command's context for proper cancellation handling. Please change the function signature to func DeleteSecret(cmd *cobra.Command), use cmd.Context() for the API call, and update the call site at line 96 to pass the cmd object.

Suggested change

func DeleteSecret() {

clientset := createKubeClientOrExit()

err := clientset.Kube().CoreV1().Secrets(utils.KmeshNamespace).Delete(context.TODO(), SecretName, metav1.DeleteOptions{})

func DeleteSecret(cmd *cobra.Command) {

clientset := createKubeClientOrExit()

err := clientset.Kube().CoreV1().Secrets(utils.KmeshNamespace).Delete(cmd.Context(), SecretName, metav1.DeleteOptions{})

Copilot

Pull Request Overview

This PR introduces a new kmeshctl secret command for comprehensive IPsec secret management in Kubernetes. The command provides create, get, and delete operations for IPsec encryption keys used in secure node-to-node communication.

Adds three subcommands: create, get, and delete for IPsec secret lifecycle management
Supports both auto-generated and user-defined encryption keys with proper validation
Includes comprehensive documentation for all command variants

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
ctl/secret/secret.go	Implements the core secret management functionality with create, get, and delete operations
docs/ctl/kmeshctl_secret.md	Updated main command documentation with examples for all subcommands
docs/ctl/kmeshctl_secret_create.md	Documentation for the create subcommand with user-defined key support
docs/ctl/kmeshctl_secret_get.md	New documentation for retrieving and displaying IPsec configurations
docs/ctl/kmeshctl_secret_delete.md	New documentation for deleting IPsec secrets

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

ctl/secret/secret.go

Copilot · 2025-09-01T10:55:07Z

ctl/secret/secret.go

+	if !cmd.Flags().Changed("key") {
+		aeadKey = make([]byte, AeadKeyLength)
+		_, err := rand.Read(aeadKey)
+		if err != nil {
+			log.Errorf("failed to generate random key: %v", err)
+			os.Exit(1)
+		}
+	} else {
+		aeadKey, err = hex.DecodeString(aeadKeyArg)
+		if err != nil {
+			log.Errorf("failed to decode hex string: %v, input: %v", err, aeadKeyArg)
+			os.Exit(1)
+		}
+	}


[nitpick] The key generation and validation logic should be extracted into separate functions to improve readability and testability. Consider creating generateRandomKey() and validateUserKey() functions.

ctl/secret/secret.go

docs/ctl/kmeshctl_secret_create.md

- Fix spacing around & operators in BPF macros to match CI expectations - Regenerate kmeshctl documentation after adding secret command - Apply consistent code formatting via make gen Signed-off-by: aicee <hhbin2000@foxmail.com>

Signed-off-by: aicee <hhbin2000@foxmail.com>

codecov · 2025-09-02T07:32:45Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.27%. Comparing base (24be567) to head (8118999).
⚠️ Report is 19 commits behind head on main.
see 8 files with indirect coverage changes

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 79623e0...8118999. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Signed-off-by: aicee <hhbin2000@foxmail.com>

hzxuzhonghu · 2025-09-02T08:03:19Z

ctl/secret/secret.go

+}
+
+func GetSecret() {
+	clientset := createKubeClientOrExit()


Ithink can move the client builde out of all the functions Get/Delete/Create

Signed-off-by: aicee <hhbin2000@foxmail.com>

hzxuzhonghu

/lgtm

hzxuzhonghu · 2025-09-02T09:22:39Z

ctl/secret/secret.go

 )

 var log = logger.NewLoggerScope("kmeshctl/secret")
+var clientset kube.CLIClient


Basically i am not a fan of global varible, you can pass the client in the function arguments

kmesh-bot · 2025-09-02T09:22:53Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hzxuzhonghu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [hzxuzhonghu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

new kmeshctl secret command

887b7f9

Signed-off-by: aicee <hhbin2000@foxmail.com>

Copilot AI review requested due to automatic review settings September 1, 2025 10:52

kmesh-bot added the kind/enhancement New feature or request label Sep 1, 2025

kmesh-bot requested review from YaoZengzeng and nlgwcy September 1, 2025 10:52

gemini-code-assist bot reviewed Sep 1, 2025

View reviewed changes

kmesh-bot added the size/L label Sep 1, 2025

gemini-code-assist bot reviewed Sep 1, 2025

View reviewed changes

Copilot AI reviewed Sep 1, 2025

View reviewed changes

zrggw force-pushed the new_kmeshctl branch from 301411b to 908b508 Compare September 2, 2025 01:41

fix: apply correct formatting and regenerate docs

c788657

- Fix spacing around & operators in BPF macros to match CI expectations - Regenerate kmeshctl documentation after adding secret command - Apply consistent code formatting via make gen Signed-off-by: aicee <hhbin2000@foxmail.com>

zrggw force-pushed the new_kmeshctl branch from 908b508 to c788657 Compare September 2, 2025 01:45

zrggw added 2 commits September 2, 2025 11:46

fix: make gen-check err

9d0ff05

Signed-off-by: aicee <hhbin2000@foxmail.com>

fix: gen-check err in kmeshctl_secret.md

c262399

Signed-off-by: aicee <hhbin2000@foxmail.com>

zrggw added 2 commits September 2, 2025 15:40

code review

387f92d

Signed-off-by: aicee <hhbin2000@foxmail.com>

new make gen

f742b88

Signed-off-by: aicee <hhbin2000@foxmail.com>

hzxuzhonghu reviewed Sep 2, 2025

View reviewed changes

adjust clientset

8118999

Signed-off-by: aicee <hhbin2000@foxmail.com>

hzxuzhonghu approved these changes Sep 2, 2025

View reviewed changes

kmesh-bot assigned hzxuzhonghu Sep 2, 2025

kmesh-bot added the lgtm label Sep 2, 2025

kmesh-bot added the approved label Sep 2, 2025

kmesh-bot merged commit c700423 into kmesh-net:main Sep 2, 2025
12 checks passed

zrggw deleted the new_kmeshctl branch September 2, 2025 09:23


		ipSecKey.Length = AeadAlgoICVLength

		secretOld, err := clientset.Kube().CoreV1().Secrets(utils.KmeshNamespace).Get(context.TODO(), SecretName, metav1.GetOptions{})

Conversation

zrggw commented Sep 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Sep 1, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 1, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 1, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Sep 1, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Sep 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

hzxuzhonghu Sep 2, 2025

Choose a reason for hiding this comment

Uh oh!

hzxuzhonghu left a comment

Choose a reason for hiding this comment

Uh oh!

hzxuzhonghu Sep 2, 2025

Choose a reason for hiding this comment

Uh oh!

kmesh-bot commented Sep 2, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

zrggw commented Sep 1, 2025 •

edited

Loading

codecov bot commented Sep 2, 2025 •

edited

Loading