Remove GPG secret parameter resolver

CHANGELOG.md

@@ -10,11 +10,15 @@ The format is based on [Keep a Changelog], and this project adheres to
 
 ## [Unreleased]
 
-### Added
+### Removed
 
-...
+- Extracted GPG secret parameter resolving to a separate gem. Please add
+[stack_master-gpg_parameter_resolver] to your bundle to continue using this
+functionality ([#295]).
 
 [Unreleased]: https://github.com/envato/stack_master/compare/v1.18.0...HEAD
+[stack_master-gpg_parameter_resolver]: https://rubygems.org/gems/stack_master-gpg_parameter_resolver
+[#295]: https://github.com/envato/stack_master/pull/295
 
 ## [1.18.0] - 2019-12-23
 
@@ -32,6 +36,7 @@ The format is based on [Keep a Changelog], and this project adheres to
 
 - Drop ruby 2.3 support in CI ([#294])
 
+[1.18.0]: https://github.com/envato/stack_master/compare/v1.17.1...v1.18.0
 [#292]: https://github.com/envato/stack_master/pull/292
 [#293]: https://github.com/envato/stack_master/pull/293
 [#294]: https://github.com/envato/stack_master/pull/294

README.md

@@ -25,9 +25,8 @@ are displayed for review.
 - Stack events will be displayed until an end state is reached.
 
 Stack parameters can be dynamically resolved at runtime using one of the
-built in parameter resolvers. Parameters can be sourced from GPG encrypted YAML
-files, other stacks outputs, by querying various AWS APIs to get resource ARNs,
-etc.
+built in parameter resolvers. Parameters can be sourced from other stacks
+outputs, or by querying various AWS APIs to get resource ARNs, etc.
 
 ## Installation
 
@@ -64,13 +63,11 @@ stack_defaults:
   role_arn: service_role_arn
 region_defaults:
   us-east-1:
-    secret_file: production.yml.gpg
     tags:
       environment: production
     notification_arns:
       - test_arn
   ap-southeast-2:
-    secret_file: staging.yml.gpg
     tags:
       environment: staging
 stacks:
@@ -138,7 +135,7 @@ stacks:
 
 - `templates` - CloudFormation, SparkleFormation or CfnDsl templates.
 - `parameters` - Parameters as YAML files.
-- `secrets` - GPG encrypted secret files.
+- `secrets` - encrypted secret files.
 - `policies` - Stack policy JSON files.
 
 ## Templates
@@ -264,35 +261,10 @@ into parameters of dependent stacks.
 
 ### Secret
 
-Note: This resolver is not supported on Windows, you can instead use the [Parameter Store](#parameter-store).
+Note: This resolver has been extracted into a dedicated gem. Please install and
+follow the instructions for the [stack_master-gpg_parameter_resolver] gem.
 
-The secret parameters resolver expects a `secret_file` to be defined in the
-stack definition which is a GPG encrypted YAML file. Once decrypted and parsed,
-the value provided to the secret resolver is used to lookup the associated key
-in the secret file. A common use case for this is to store database passwords.
-
-stack_master.yml:
-
-```yaml
-stacks:
-  us-east-1:
-    my_app:
-      template: my_app.json
-      secret_file: production.yml.gpg
-```
-
-secrets/production.yml.gpg, when decrypted:
-
-```yaml
-db_password: my-password
-```
-
-parameters/my_app.yml:
-
-```yaml
-db_password:
-  secret: db_password
-```
+[stack_master-gpg_parameter_resolver]: https://github.com/envato/stack_master-gpg_parameter_resolver
 
 ### Parameter Store
 

features/stack_defaults.feature

@@ -10,14 +10,12 @@ Feature: Stack defaults
         ap_southeast_2:
           notification_arns:
           - test_arn_1
-          secret_file: staging.yml.gpg
           tags:
             environment: staging
           stack_policy_file: my_policy.json
         us_east_1:
           notification_arns:
           - test_arn_2
-          secret_file: production.yml.gpg
           tags:
             environment: production
       stacks:

lib/stack_master.rb

@@ -70,7 +70,6 @@ module ParameterResolvers
     autoload :AmiFinder, 'stack_master/parameter_resolvers/ami_finder'
     autoload :StackOutput, 'stack_master/parameter_resolvers/stack_output'
     autoload :Ejson, 'stack_master/parameter_resolvers/ejson'
-    autoload :Secret, 'stack_master/parameter_resolvers/secret'
     autoload :SnsTopicName, 'stack_master/parameter_resolvers/sns_topic_name'
     autoload :SecurityGroup, 'stack_master/parameter_resolvers/security_group'
     autoload :LatestAmiByTags, 'stack_master/parameter_resolvers/latest_ami_by_tags'

lib/stack_master/stack_definition.rb

@@ -9,7 +9,6 @@ class StackDefinition
                   :notification_arns,
                   :base_dir,
                   :template_dir,
-                  :secret_file,
                   :ejson_file,
                   :ejson_file_region,
                   :ejson_file_kms,
@@ -47,7 +46,6 @@ def ==(other)
         @allowed_accounts == other.allowed_accounts &&
         @notification_arns == other.notification_arns &&
         @base_dir == other.base_dir &&
-        @secret_file == other.secret_file &&
         @ejson_file == other.ejson_file &&
         @ejson_file_region == other.ejson_file_region &&
         @ejson_file_kms == other.ejson_file_kms &&

spec/fixtures/stack_master.yml

@@ -18,7 +18,6 @@ region_defaults:
     notification_arns:
       - test_arn
     role_arn: test_service_role_arn
-    secret_file: production.yml.gpg
     stack_policy_file: my_policy.json
   staging:
     tags:
@@ -27,7 +26,6 @@ region_defaults:
     notification_arns:
       - test_arn_3
     role_arn: test_service_role_arn3
-    secret_file: staging.yml.gpg
 stacks:
   us-east-1:
     myapp_vpc:

spec/stack_master/config_spec.rb

@@ -13,7 +13,6 @@
       notification_arns: ['test_arn', 'test_arn_2'],
       role_arn: 'test_service_role_arn2',
       base_dir: base_dir,
-      secret_file: 'production.yml.gpg',
       stack_policy_file: 'my_policy.json',
       additional_parameter_lookup_dirs: ['production']
     )
@@ -104,14 +103,12 @@
         'tags' => { 'environment' => 'production' },
         'role_arn' => 'test_service_role_arn',
         'notification_arns' => ['test_arn'],
-        'secret_file' => 'production.yml.gpg',
         'stack_policy_file' => 'my_policy.json'
       },
       'ap-southeast-2' => {
         'tags' => {'environment' => 'staging', 'test_override' => 1 },
         'role_arn' => 'test_service_role_arn3',
         'notification_arns' => ['test_arn_3'],
-        'secret_file' => 'staging.yml.gpg'
       }
     })
   end
@@ -139,7 +136,6 @@
       notification_arns: ['test_arn_3', 'test_arn_4'],
       template: 'myapp_vpc.rb',
       base_dir: base_dir,
-      secret_file: 'staging.yml.gpg',
       additional_parameter_lookup_dirs: ['staging']
     ))
     expect(loaded_config.find_stack('ap-southeast-2', 'myapp-web')).to eq(StackMaster::StackDefinition.new(
@@ -157,7 +153,6 @@
       notification_arns: ['test_arn_3'],
       template: 'myapp_web',
       base_dir: base_dir,
-      secret_file: 'staging.yml.gpg',
       additional_parameter_lookup_dirs: ['staging']
     ))
   end

spec/stack_master/validator_spec.rb

@@ -40,18 +40,6 @@
         expect { validator.perform }.to output(/myapp_vpc: invalid/).to_stdout
       end
     end
-
-    context "validate is called from from a continuous integration system with no access to secrets" do
-      let(:stack_name) { 'myapp_vpc_with_secrets' }
-      let(:secret) { instance_double(StackMaster::ParameterResolvers::Secret) }
-      before do
-        allow(StackMaster::ParameterResolvers::Secret).to receive(:new).and_return(secret)
-      end
-      it "does not prompt for the secret key" do
-        expect(secret).not_to receive(:resolve)
-        validator.perform
-      end
-    end
   end
 
 end

stack_master.gemspec

@@ -64,6 +64,5 @@ Gem::Specification.new do |spec|
   spec.add_dependency "multi_json"
   spec.add_dependency "hashdiff", "~> 1"
   spec.add_dependency "ejson_wrapper"
-  spec.add_dependency "dotgpg" unless windows_build
   spec.add_dependency "diff-lcs" if windows_build
 end