Kubernetes / kubectl print all secrets - kubernetes

Question

I would like to use kubectl to print out all key-value pairs in my Secrets. I cannot figure out how to do this in one line with the -o --jsonpath flag or by piping into jq. I could certainly make a script to do this but I feel there must be a better way, given that the kubernetes GUI is pretty straightforward and liberal when it comes to letting you view Secrets.
Say I create secret like so:
kubectl create secret generic testsecret --from-literal=key1=val1 --from-literal=key2=val2
Now I can run kubectl get secret testsecret -o json to get something like:
{
"apiVersion": "v1",
"data": {
"key1": "dmFsMQ==",
"key2": "dmFsMg=="
},
...
}
I can do something like
kubectl get secret testsecret -o jsonpath='{.data}'
or
kubectl get secret testsecret -o json | jq '.data'
to get my key-value pairs in non-list format then I'd have to base64 --decode the values.
What is the easiest way to get a clean list of all my key-value pairs? Bonus points for doing this across all Secrets (as opposed to just one specific one, as I did here).

Answer 1

Sufficiently recent versions of jq have a filter for decoding base64 but it can only be used if the value that was encoded is a valid JSON string.
Anyway, you could start by trying:
.data | map_values(#base64d)

Answer 2

I read this question as asking for how to decode all secrets in one go. I built on the accepted answer to produce a one-liner to do this:
kubectl get secrets -o json | jq '.items[] | {name: .metadata.name,data: .data|map_values(#base64d)}'
This has the added benefit of listing the name of the secret along with the decoded values for readability.

Answer 3

If you need to extract tls certificates and/or keys from a kubernetes secret and you have an older jq version not supporting map_values(#base64d):
kubectl get secrets tls-cert -o json | jq '.data' | cut -d '"' -f 4 | tr -d '{}' | base64 --decode

Answer 4

When using the accepted answer you may come across exception
jq: error (at <stdin>:96): Cannot iterate over null (null)
This might be because some json might not be fully formed, use an additional filter
kubectl get secrets -o json | jq '.items[] | select(null != .data) | {name: .metadata.name,data: .data|map_values(#base64d)}'
The above will ensure to produce expected results