Allow pulumi stack export to decrypt secrets

[stack72]

Fixes: #2918

This allows us to run the command pulumi stack export --show-secrets
it will also introduce the changes that allows the import to handle
when plain text is included in the import file

[stack72]

@lukehoban / @pgavlin would love eyes on this when you get some time please

[lukehoban]

A few notes. But would definitely be great for @pgavlin to take a look too.

[pgavlin]

Just a few things offhand--I'll take a more detailed look later today.

[NinoFloris]

We're running into to this, the workaround to migrate a stack - we're going from default secret provider to kms- is very tedious without this. Any update?

[stack72]

Hi @NinoFloris

We paused this to concentrate on the 2.0 work so I will get back to this shortly

Paul

[stack72]

This allows to export and import secrets

~/code/secrets
▶ pulumi stack export --show-secrets > test.json

~/code/secrets
▶ pulumi stack import --file test.json
Import successful.

~/code/secrets
▶ pulumi stack export > test.json

~/code/secrets
▶ pulumi stack import --file test.json
Import successful.

I can see the secrets in the output as well:

▶ cat test.json
{
    "version": 3,
    "deployment": {
        "manifest": {
            "time": "2020-05-05T22:31:33.276569+01:00",
            "magic": "7c37e5b973ae9a0866c7b0097ad75696c2881d030dcc17834b2ef914fe3ecba0",
            "version": "v2.2.0-alpha.1588707575+g7b446d6c.dirty"
        },
        "secrets_providers": {
            "type": "service",
            "state": {
                "url": "https://api.pulumi.com",
                "owner": "stack72",
                "project": "secrets",
                "stack": "dev"
            }
        },
        "resources": [
            {
                "urn": "urn:pulumi:dev::secrets::pulumi:pulumi:Stack::secrets-dev",
                "custom": false,
                "type": "pulumi:pulumi:Stack",
                "outputs": {
                    "secret": {
                        "4dabf18193072939515e22adb298388d": "1b47061264138c4ac30d75fd1eb44270",
                        "ciphertext": "AAABADjwqpv+jPnI8iB7ctNgF9tLe6cjry9KKIg8YNblA1JFiVIPzfcrmCsVhfXJ7hq+o73m9A=="
                    }
                }
            },
            {
                "urn": "urn:pulumi:dev::secrets::pulumi:providers:random::default_2_1_0",
                "custom": true,
                "id": "e4810fc7-d485-4cda-b62c-95e767296cdd",
                "type": "pulumi:providers:random",
                "inputs": {
                    "version": "2.1.0"
                },
                "outputs": {
                    "version": "2.1.0"
                }
            },
            {
                "urn": "urn:pulumi:dev::secrets::random:index/randomString:RandomString::my-string",
                "custom": true,
                "id": "O[tUh1E-TF\u003eW+P=t",
                "type": "random:index/randomString:RandomString",
                "inputs": {
                    "__defaults": [
                        "lower",
                        "minLower",
                        "minNumeric",
                        "minSpecial",
                        "minUpper",
                        "number",
                        "upper"
                    ],
                    "length": 16,
                    "lower": true,
                    "minLower": 0,
                    "minNumeric": 0,
                    "minSpecial": 0,
                    "minUpper": 0,
                    "number": true,
                    "special": true,
                    "upper": true
                },
                "outputs": {
                    "__meta": "{\"schema_version\":\"1\"}",
                    "id": "O[tUh1E-TF\u003eW+P=t",
                    "length": 16,
                    "lower": true,
                    "minLower": 0,
                    "minNumeric": 0,
                    "minSpecial": 0,
                    "minUpper": 0,
                    "number": true,
                    "result": {
                        "4dabf18193072939515e22adb298388d": "1b47061264138c4ac30d75fd1eb44270",
                        "ciphertext": "AAABADDSJYg7UC9JUNdQ3HdO+AXjxd2IlLN49Wd7qfXwea1T73F/DjsgndGoz5O6876LR0uN3Q=="
                    },
                    "special": true,
                    "upper": true
                },
                "parent": "urn:pulumi:dev::secrets::pulumi:pulumi:Stack::secrets-dev",
                "provider": "urn:pulumi:dev::secrets::pulumi:providers:random::default_2_1_0::e4810fc7-d485-4cda-b62c-95e767296cdd",
                "propertyDependencies": {
                    "length": null,
                    "special": null
                },
                "additionalSecretOutputs": [
                    "result"
                ]
            }
        ]
    }
}

[lukehoban]

LGTM

BTW - also confirmed that this works 😄:

$ pulumi stack init fromstack
$ pulumi config set aws:region us-west-2
$ pulumi up --skip-preview
$ pulumi stack init tostack
$ cp Pulumi.fromstack.yaml Pulumi.tostack.yaml
$ pulumi stack export --show-secrets -s fromstack | sed 's/fromstack/tostack/g' | pulumi stack import -s tostack
$ pulumi preview -s tostack
Previewing update (tostack):
     Type                 Name            Plan     
     pulumi:pulumi:Stack  node14-tostack           
 
Resources:
    2 unchanged