Skip to content

Fix logging replacing secrets in values.yaml with (sensitive value) #1611

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix logging replacing secrets in values.yaml with (sensitive value) #1611

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions helm/data_helm_template.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -996,6 +996,7 @@ func applySetSensitiveValue(base map[string]interface{}, setSensitive SetSensiti
func LogValuesModel(ctx context.Context, values map[string]interface{}, state *HelmTemplateModel) diag.Diagnostics {
var diags diag.Diagnostics

// Note: Use json to do a deep clone of the values map so we don't modify the original when cloaking sensitive values
asJSON, err := json.Marshal(values)
if err != nil {
diags.AddError("Error marshaling values to JSON", fmt.Sprintf("Failed to marshal values to JSON: %s", err))
Expand Down
26 changes: 20 additions & 6 deletions helm/resource_helm_release.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ import (
"context"
"encoding/json"
"fmt"
"maps"
"net/url"
"os"
pathpkg "path"
Expand Down Expand Up @@ -1379,18 +1378,33 @@ func getValue(base map[string]interface{}, set setResourceModel) diag.Diagnostic

func logValues(ctx context.Context, values map[string]interface{}, state *HelmReleaseModel) diag.Diagnostics {
var diags diag.Diagnostics
// Cloning values map
c := maps.Clone(values)

cloakSetValues(c, state)
// Note: Use json to do a deep clone of the values map so we don't modify the original when cloaking sensitive values
asJSON, err := json.Marshal(values)
if err != nil {
diags.AddError("Error marshaling values to JSON", fmt.Sprintf("Failed to marshal values to JSON: %s", err))
return diags
}

var clonedValues map[string]interface{}
err = json.Unmarshal(asJSON, &clonedValues)
if err != nil {
diags.AddError("Error unmarshaling JSON to map", fmt.Sprintf("Failed to unmarshal JSON to map: %s", err))
return diags
}

// Apply cloaking or masking for sensitive values
cloakSetValues(clonedValues, state)

y, err := yaml.Marshal(c)
// Convert the modified map to YAML for logging purposes
yamlData, err := yaml.Marshal(clonedValues)
if err != nil {
diags.AddError("Error marshaling map to YAML", fmt.Sprintf("Failed to marshal map to YAML: %s", err))
return diags
}

tflog.Debug(ctx, fmt.Sprintf("---[ values.yaml ]-----------------------------------\n%s\n", string(y)))
// Log the final YAML representation of the values
tflog.Debug(ctx, fmt.Sprintf("---[ values.yaml ]-----------------------------------\n%s\n", string(yamlData)))

return diags
}
Expand Down