Decode input secrets used in template stringData #446
Conversation
Signed-off-by: Matthew Carpenter <carpenterm@vmware.com>
carpenterm
force-pushed
the
fix-double-encoding
branch
from
617ff2e
to
1876909
Compare
| secretTemplateOwnerRef("secretTemplate"), | ||
| }, | ||
| }, | ||
| Data: map[string][]byte{ |
There was a problem hiding this comment.
139-142 should be covered by the previous unit-test.
| }, | ||
| }}, | ||
| JSONPathTemplate: &sg2v1alpha1.JSONPathTemplate{ | ||
| Data: map[string]string{ |
There was a problem hiding this comment.
109-112 should be covered by the previous unit-test. This test is only for StringData
| @@ -283,7 +284,12 @@ func evaluateTemplate(template *sg2v1alpha1.JSONPathTemplate, values map[string] | |||
| } | |||
|
|
|||
| // Template Secret StringData | |||
| stringData, err := evaluate(template.StringData, values) | |||
| decodedValues, err := decodeSecrets(values) | |||
There was a problem hiding this comment.
This is a pre-processing step which ends up having to iterate all the values even if you never specify a SecretData field. We also don't have any test for the "else" case, i.e.
if obj.GetKind() == "Secret" { } else { // no tests }
Is there a way to fold this into our existing evaluate function or a new function evaluateStringData which could delegate to the existing evaluateBytes or similar for most of the work.
|
I need this too, can I do something to help with this ? |
|
Sorry but I am not working on this anymore, by the time the review came in I'd found another way using Kyverno. |
github-actions
bot
added
the
carvel-triage
If an input resource is of kind Secret, and that is used in an expression in the stringData field of a SecretTemplate, then base64 decode it when evaluating the stringData field.
Fixes #445: Secrets used as input resources are double base64 encoded when used in stringData