https://www.adyxax.org/blog/2020/08/06/get-tls-certificate-and-key-from-a-kubernetes-secret/#the-solution

kubectl get secret mysecret -o json -o=jsonpath=”{.data.tls\.crt}” | base64 -d > certchain.pem
kubectl get secret mysecret -o json -o=jsonpath=”{.data.tls\.key}” | base64 -d > cert.key

““
if [[ “$OSTYPE” == “linux-gnu”* ]]; then
SED=”sed”
elif [[ “$OSTYPE” == “darwin”* ]]; then
# Mac OSX: brew install gnu-sed
SED=”gsed”
fi
“`

—-

“`
#!/usr/bin/env bash

KUBECTL=”kubectl”
OUTPUT=${1:-“$(pwd)/certificates”}
SED=”sed”

if [[ “$OSTYPE” == “linux-gnu”* ]]; then
SED=”sed”
elif [[ “$OSTYPE” == “darwin”* ]]; then
# Mac OSX: brew install gnu-sed
SED=”gsed”
fi

for secret in $(${KUBECTL} get secrets –field-selector type=kubernetes.io/tls –all-namespaces -o=custom-columns=’NAMESPACE:metadata.namespace’,’NAME:metadata.name’ | tail +2 | ${SED} -E ‘s/\s+/\//g’); do
NAMESPACE=$(echo ${secret} | cut -d”/” -f1)
NAME=$(echo ${secret} | cut -d”/” -f2)
echo -n “${NAMESPACE}: ${NAME}>”

if [ -n “$(${KUBECTL} get secret -n ${NAMESPACE} ${NAME} -o json | jq -r ‘.data.”tls.crt”‘ | base64 -d)” ]; then

DOMAIN=$(${KUBECTL} get secret -n ${NAMESPACE} ${NAME} -o json | jq -r ‘.data.”tls.crt”‘ | base64 -d | openssl x509 -noout -text | grep “Subject: CN = ” | ${SED} -E ‘s/\s+Subject: CN = ([^ ]*)/\1/g’)
echo -n ” ${DOMAIN}”

mkdir -p “${OUTPUT}/${DOMAIN}”

${KUBECTL} get secret -n ${NAMESPACE} ${NAME} -o json | jq -r ‘.data.”tls.key”‘ | base64 -d > “${OUTPUT}/${DOMAIN}/privkey.pem”
${KUBECTL} get secret -n ${NAMESPACE} ${NAME} -o json | jq -r ‘.data.”tls.crt”‘ | base64 -d > “${OUTPUT}/${DOMAIN}/fullchain.pem”

echo ” DONE”
else
echo ” FAILED”
fi
done
““

##Get all tls keys from a k8s namespace
#!/bin/bash

NAMESPACE=”external-tls”

while IFS= read -r SECRET_NAME
do
# Export TLS Cert
kubectl get secret -n “${NAMESPACE}” “${SECRET_NAME}” -o json | jq -r ‘.data.”tls.crt”‘ | base64 -d > “${SECRET_NAME}.crt”

# Export Private Key
kubectl get secret -n “${NAMESPACE}” “${SECRET_NAME}” -o json | jq -r ‘.data.”tls.key”‘ | base64 -d > “${SECRET_NAME}.key”

done < 1 {print $1}’)