generated from pulumi/pulumi-provider-boilerplate
-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fixing Deployment Secrets - Plaintext in Inputs (#325)
### Note: there is an alternative implementation of this PR - #320 ### Summary - Added logic to save ciphertext into the output properties for secret values, allowing comparison on refresh of just ciphertext, fixing #123 - Import now works as well, including code generation (with dummy values for secrets) - Migrated to new PUT API and updated client to actually return DeploymentSettings ### Testing - Tested pulumi up, refresh, import and up from previous version of the provider (for unchanged DS inputs, migrating to this new way of saving will require refresh and then up) Example TS program (Sadly can't use Dotnet, due to bug with maps): ``` const settings = new service.DeploymentSettings("deployment_settings", { organization: "IaroslavTitov", project: "PulumiDotnet", stack: "SdkTest5", operationContext: { environmentVariables: { TEST_VAR: "fooa", SECRET_VAR: config.requireSecret("my_secret"), } }, sourceContext: { git: { repoUrl: "https://github.com/pulumi/deploy-demos.git", branch: "refs/heads/main", repoDir: "pulumi-programs/simple-resource", gitAuth: { sshAuth: { sshPrivateKey: "privatekey", password: secret, } } } } }); ``` Secret resource values end up with just cipher, while plaintext is stored in inputs: ``` "sshAuth": { "password": "AAABAD6/2Nroj62qORoHOLofFOkRhdUNwCAYeC86nABU/G4AO5I7Fw==", "sshPrivateKey": "AAABABqRIQ1bZbvU/hrlpX1Rh9sj9OCyArjG0SUILPQmb0KSCFIrz6bK" } ``` Passwords and sshKey are forced into twin secrets, Environment Variables are optionally twin secrets, everything else uses normal Pulumi workflows, because they are not secret in Pulumi Service. Import of the above code generates successfully with dummy values for secrets: ``` const ds1 = new pulumiservice.DeploymentSettings("ds1", { operationContext: { environmentVariables: { SECRET_VAR: pulumi.secret("<REPLACE WITH ACTUAL SECRET VALUE>"), TEST_VAR: "fooa", }, }, organization: "IaroslavTitov", project: "PulumiDotnet", sourceContext: { git: { branch: "refs/heads/main", gitAuth: { sshAuth: { password: pulumi.secret("<REPLACE WITH ACTUAL SECRET VALUE>"), sshPrivateKey: pulumi.secret("<REPLACE WITH ACTUAL SECRET VALUE>"), }, }, repoDir: "pulumi-programs/simple-resource", repoUrl: "https://github.com/pulumi/deploy-demos.git", }, }, stack: "SdkTest5", }, { protect: true, }); ```
- Loading branch information
1 parent
5f7e42d
commit 6853f00
Showing
5 changed files
with
317 additions
and
69 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,5 +1,6 @@ | ||
### Improvements | ||
|
||
### Bug Fixes | ||
- Introduced secrets in Deployment Settings, fixed refresh and import [#123](https://github.com/pulumi/pulumi-pulumiservice/issues/123) | ||
|
||
### Miscellaneous |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.