Inject secrets into parameters too

[carolynvs]

The secrets plugin lets you inject values from external sources, such as key vault, into a credential. I want to be able to keep my secrets safe in my vault and inject them into parameters as well, since CNAB says boring stuff (non-identity) such as database passwords should be parameters and not credentials. KEEP ALL THE THINGS SAFE PLZ! 🙇‍♀

[dev-drprasad]

I would like to help with this issue.

[carolynvs]

Great! I could use some help thinking about the design of this feature. We aren't quite ready to start coding yet.

For some background, in the CNAB spec, there is a distinction between parameters and credentials. Credentials are intended not for sensitive information but for information related to the identity of the person executing the bundle. For example your credentials for aws. Anything else should be a parameter, like the application’s password to connect to mysql. Even though that really should be protected carefully too! 😄

The CNAB spec has the runtime and the tools (like porter) treat credentials and parameters very differently because of this distinction:

• credentials, when they are files, can be mounted into the docker image
• credentials are not persisted with the claim
• the cli collects them differently (credentials through credential sets, parameters through --param NAME=VALUE)

With plugins, Porter supports having credential sets resolve their value against a secret store in the cloud (or anywhere really). This is more secure. But how do we do the same thing for parameters: 🤔

We can change how we pass in parameters, it doesn’t have to be a flag, or we can change how the flag works or add a new flag, etc. Essentially we need a way for the user to say, "Here is how to get the value for this parameter from a secret store" i.e. this is the key to use when looking it up.

All of the configuration of the secret store is already taken care of from the plugins work, so you don’t need to worry about that.

SO! 😅 If you would like to think about the design of that, and what the user experience (UX) would be, that is the real work for this story.

[dev-drprasad]

Let me think about the design. I will un-assign myself so that other people can engage on this issue.

[vdice]

This functionality is now in place. The ability to declare parameter(s) with secret sources was added with #1053 and the azure plugin already has the logic to resolve secrets from its supported backend (Azure Keyvault). 🎉