Retrieve KOTS Config Values When the Admin Console is Unavailable

How do I?
,
1

When the KOTS Admin Console or CLI is unavailable or not functioning properly, we’ve written a tool that can be used to extract and decrypt KOTS configuration values directly from the rqlite database.

When to Use This

  • kotsadm pods are down or unhealthy

  • kubectl kots get config --decrypt fails or hangs

  • Admin Console is unavailable

Prerequisites

  • kubectl with access to your KOTS namespace

  • Go 1.19+ (for compiling)

Quick Start

Compile the Binary


*# Download source*

wget https://gist.githubusercontent.com/diamonwiggins/d1f4246274039a9a0b1021f69d4b0883/raw/decrypt-kots-config.go



*# Initialize module and get dependencies*

go mod init kots-decrypt

go get sigs.k8s.io/yaml

go mod tidy



*# Compile for Linux (most common)*

GOOS=linux GOARCH=amd64 go build -o kots-decrypt-config kots-decrypt-config.go



*# For macOS Intel*

GOOS=darwin GOARCH=amd64 go build -o kots-decrypt-config kots-decrypt-config.go



*# For macOS Apple Silicon*

GOOS=darwin GOARCH=arm64 go build -o kots-decrypt-config kots-decrypt-config.go

Usage


*# Basic usage*

./kots-decrypt-config -n <namespace>



*# Specific sequence*

./kots-decrypt-config -n default -s 5



*# Custom output directory*

./kots-decrypt-config -n default -o /var/backups



*# Help*

./kots-decrypt-config --help

Output

Creates two files in the output directory (default: /tmp):

  • kots-config-raw.yaml - Encrypted config values

  • kots-config-decrypted.yaml - Decrypted values in valuePlaintext fields

Example decrypted output:


apiVersion: kots.io/v1beta1
kind: ConfigValues
spec:
  values:
    database_password:
      valuePlaintext: myDecryptedPassword123  *# Decrypted!*
    database_host:
      default: postgres.example.com

How It Works

  1. Retrieves encryption key from kotsadm-encryption secret (handles double base64 encoding)

  2. Retrieves rqlite password from kotsadm-rqlite secret

  3. Port-forwards to rqlite on port 4001

  4. Queries rqlite for config values (bypasses kotsadm)

  5. Decrypts password fields using AES-192-GCM

  6. Outputs both raw and decrypted configs

Security Notes

:warning: The decrypted file contains plaintext passwords!


*# Secure the output*

chmod 600 /tmp/kots-config-decrypted.yaml



*# Delete when done*

rm /tmp/kots-config-*.yaml

Source Code

Complete source: kots-decrypt-config.go