Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

escape secrets that look like variables #3717

Open
michel-laterman opened this issue Jul 11, 2024 · 2 comments
Open

escape secrets that look like variables #3717

michel-laterman opened this issue Jul 11, 2024 · 2 comments
Assignees
Labels
enhancement New feature or request Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team

Comments

@michel-laterman
Copy link
Contributor

fleet-server has a secrets injection where a secret defined in a special index in injected in a policy before it is sent to an agent
elastic-agent has support for escaping variables in an input where if given $${X} then ${X} would be passed to components.

Fleet-server should escape secrets that look like variables before passing them to the agent, so any secret that looks like ${X} would be transformed into $${X}, but secrets that look like they have been escaped are not effected.

@michel-laterman michel-laterman added enhancement New feature or request Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team labels Jul 11, 2024
@blakerouse
Copy link
Contributor

You should actually escape anything that looks like '${'. Ignore the ending bracket, because even that will cause an issue as then the AST parser will complain that there is no closing bracket.

@michel-laterman
Copy link
Contributor Author

So far my unit tests show that if an escaped sequence ($$) is under the inputs key it's not altered by the agent, but that the fleet-ui is doing the injection when a value is defined; i think this would also apply to secret values with $$ in them; i'm not sure if this issue is needed, see comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team
Projects
None yet
Development

No branches or pull requests

2 participants