systemd/crc-pullsecret.sh: don't leak the pull secrets

Author: kpouget

systemd/crc-pullsecret.sh

@@ -1,20 +1,33 @@
 #!/bin/bash
 
+set -o pipefail
+set -o errexit
+set -o nounset
+set -o errtrace
 set -x
 
 source /usr/local/bin/crc-systemd-common.sh
 export KUBECONFIG="/opt/kubeconfig"
 
 wait_for_resource secret
 
+set +x # disable the logging to avoid leaking the pull secrets
+
 # check if existing pull-secret is valid if not add the one from /opt/crc/pull-secret
 existingPsB64=$(oc get secret pull-secret -n openshift-config -o jsonpath="{['data']['\.dockerconfigjson']}")
 existingPs=$(echo "${existingPsB64}" | base64 -d)
 
-echo "${existingPs}" | jq -e '.auths'
+# check if the .auths field is there
+echo "${existingPs}" | jq -e '.auths' > /dev/null
+has_auths_field=$?
 
-if [[ $? != 0 ]]; then
-    pullSecretB64=$(base64 -w0 < /opt/crc/pull-secret)
-    oc patch secret pull-secret -n openshift-config --type merge -p "{\"data\":{\".dockerconfigjson\":\"${pullSecretB64}\"}}"
+if [[ $has_auths_field == 0 ]]; then
+    echo "Cluster already has the pull secrets, nothing to do"
+    exit 0
 fi
 
+echo "Cluster doesn't have the pull secrets. Setting them from /opt/crc/pull-secret ..."
+pullSecretB64=$(base64 -w0 < /opt/crc/pull-secret)
+oc patch secret pull-secret -n openshift-config --type merge -p "{\"data\":{\".dockerconfigjson\":\"${pullSecretB64}\"}}"
+
+exit 0