public_git
/
helmfile
mirror of https://github.com/helmfile/helmfile.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

feat: --suppress-secrets of diff and apply commands (#272) 

Adds `--suppress-secrets` to `helmfile apply` and `helmfile diff`, so that the diff command omits the contents of secrets from its output. This is a security feature that should always be turned on for CI/CD use-cases.

With `--suppress-secrets`, the output when there is any change looks like:

```
Comparing bar stable/grafana
default, baz-grafana, Secret (v1) has changed:
+ Changes suppressed on sensitive content of type Secret
```

Resolves #269
This commit is contained in:
KUOKA Yusuke 2018-09-02 21:21:29 +09:00 committed by GitHub
parent 046281c70f
commit 54f1567294
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
main.go
View File

@ -181,6 +181,10 @@ func main() {
Name: "detailed-exitcode", Name: "detailed-exitcode",
Usage: "return a non-zero exit code when there are changes", Usage: "return a non-zero exit code when there are changes",
}, },
cli.BoolFlag{
Name: "suppress-secrets",
Usage: "suppress secrets in the output. highly recommended to specify on CI/CD use-cases",
},
cli.IntFlag{ cli.IntFlag{
Name: "concurrency", Name: "concurrency",
Value: 0, Value: 0,
@ -189,7 +193,7 @@ func main() {
}, },
Action: func(c *cli.Context) error { Action: func(c *cli.Context) error {
return findAndIterateOverDesiredStatesUsingFlags(c, func(state *state.HelmState, helm helmexec.Interface) []error { return findAndIterateOverDesiredStatesUsingFlags(c, func(state *state.HelmState, helm helmexec.Interface) []error {
return executeDiffCommand(c, state, helm, c.Bool("detailed-exitcode")) return executeDiffCommand(c, state, helm, c.Bool("detailed-exitcode"), c.Bool("suppress-secrets"))
}) })
}, },
}, },
@ -276,10 +280,14 @@ func main() {
Name: "auto-approve", Name: "auto-approve",
Usage: "Skip interactive approval before applying", Usage: "Skip interactive approval before applying",
}, },
cli.BoolFlag{
Name: "suppress-secrets",
Usage: "suppress secrets in the diff output. highly recommended to specify on CI/CD use-cases",
},
}, },
Action: func(c *cli.Context) error { Action: func(c *cli.Context) error {
return findAndIterateOverDesiredStatesUsingFlags(c, func(state *state.HelmState, helm helmexec.Interface) []error { return findAndIterateOverDesiredStatesUsingFlags(c, func(state *state.HelmState, helm helmexec.Interface) []error {
errs := executeDiffCommand(c, state, helm, true) errs := executeDiffCommand(c, state, helm, true, c.Bool("suppress-secrets"))
// sync only when there are changes // sync only when there are changes
if len(errs) > 0 { if len(errs) > 0 {
@ -441,7 +449,7 @@ func executeSyncCommand(c *cli.Context, state *state.HelmState, helm helmexec.In
return state.SyncReleases(helm, values, workers) return state.SyncReleases(helm, values, workers)
} }
func executeDiffCommand(c *cli.Context, state *state.HelmState, helm helmexec.Interface, detailedExitCode bool) []error { func executeDiffCommand(c *cli.Context, state *state.HelmState, helm helmexec.Interface, detailedExitCode, suppressSecrets bool) []error {
args := args.GetArgs(c.String("args"), state) args := args.GetArgs(c.String("args"), state)
if len(args) > 0 { if len(args) > 0 {
helm.SetExtraArgs(args...) helm.SetExtraArgs(args...)
@ -459,7 +467,7 @@ func executeDiffCommand(c *cli.Context, state *state.HelmState, helm helmexec.In
values := c.StringSlice("values") values := c.StringSlice("values")
workers := c.Int("concurrency") workers := c.Int("concurrency")
return state.DiffReleases(helm, values, workers, detailedExitCode) return state.DiffReleases(helm, values, workers, detailedExitCode, suppressSecrets)
} }
func findAndIterateOverDesiredStatesUsingFlags(c *cli.Context, converge func(*state.HelmState, helmexec.Interface) []error) error { func findAndIterateOverDesiredStatesUsingFlags(c *cli.Context, converge func(*state.HelmState, helmexec.Interface) []error) error {

6
state/state.go
View File

@ -215,7 +215,7 @@ func (state *HelmState) SyncReleases(helm helmexec.Interface, additionalValues [
} }
// DiffReleases wrapper for executing helm diff on the releases // DiffReleases wrapper for executing helm diff on the releases
func (state *HelmState) DiffReleases(helm helmexec.Interface, additionalValues []string, workerLimit int, detailedExitCode bool) []error { func (state *HelmState) DiffReleases(helm helmexec.Interface, additionalValues []string, workerLimit int, detailedExitCode, suppressSecrets bool) []error {
var wgRelease sync.WaitGroup var wgRelease sync.WaitGroup
var wgError sync.WaitGroup var wgError sync.WaitGroup
errs := []error{} errs := []error{}
@ -256,6 +256,10 @@ func (state *HelmState) DiffReleases(helm helmexec.Interface, additionalValues [
flags = append(flags, "--detailed-exitcode") flags = append(flags, "--detailed-exitcode")
} }
if suppressSecrets {
flags = append(flags, "--suppress-secrets")
}
if len(errs) == 0 { if len(errs) == 0 {
if err := helm.DiffRelease(release.Name, normalizeChart(state.basePath, release.Chart), flags...); err != nil { if err := helm.DiffRelease(release.Name, normalizeChart(state.basePath, release.Chart), flags...); err != nil {
errs = append(errs, err) errs = append(errs, err)