1Password secret references for local Kubernetes secret manifests - #101
Conversation
… halt skaffold on compile failure
allanchau
left a comment
allanchau
left a comment
There was a problem hiding this comment.
@smebberson Question for you here
| Mustache.render(content, service.locals), | ||
| 'utf8' | ||
| ); | ||
| // Secret references are resolved before the template is rendered, so |
There was a problem hiding this comment.
@smebberson Don't you want to render the template first? what if you had a password with curly braces in it?
There was a problem hiding this comment.
@allanchau, it is a bit of a catch-22 because the default advice from 1Password actually uses {{op://}}. I decided to roll with bare op:// references (i.e. not wrapped in {{}}) and it does still work - so the ordering you've suggested is the right approach. That's been updated.
…flow through the template engine
allanchau
left a comment
allanchau
left a comment
There was a problem hiding this comment.
@smebberson Not sure if you want to tackle these too, it doesn't seem likely to ever happen
- Severity: Low
- Confidence: High
- Location: bin/lib/c-kc.js:100-104
- Issue: encodeSecretStringData flips inStringData = false for any line that doesn't match the field regex /^(\s+)([^:\s]+):\s*(.*)$/ — including blank lines and indented comments inside the stringData block. A blank line or # comment between entries silently stops encoding; all subsequent keys are written under data: as plaintext. kubectl apply then fails with an "error decoding from base64" style error at apply time, and the compiled secret is still deleted afterwards by removeCompiledSecrets — confusing and leaves the cluster with a stale secret.
- Fix: Capture the stringData key's indentation and only treat lines indented deeper as fields; only reset inStringData on a line indented less than or equal to it (or at column 0). Alternatively parse the YAML properly instead of line-by-line regex.
- Severity: Low
- Confidence: High
- Location: bin/lib/c-kc.js:85-90
- Issue: If a secret template contains both data: and stringData: (valid in Kubernetes), the output contains two data: keys, producing an invalid/duplicate-key manifest. The README doesn't call this out.
- Fix: Reject templates containing both blocks with a clear error, or merge stringData into the existing data block.
| } catch (e) { | ||
| // Do nothing. | ||
| // It just means we don't have a templ file to render. | ||
| // It just means there was no compiled secret to remove. |
There was a problem hiding this comment.
Do we need to rethrow other errors?
EACCES/EPERM/EROFS would silently leave plaintext secret files on disk while c kc secrets-clean reports success.
…ce secret removal failures
|
@allanchau, I've resolved these now. |
This branch is waiting to be deployed
2 participants
Adds support for 1Password secret references (
op://) within Kubernetes manifest templates, so projects can keep secret manifests in git without plaintext secrets, resolving them to real values only at compile time.Related PRs
Notes
.yaml.tmplcontainingop://references has them resolved withop inject(file mode) before the template is rendered, so template placeholders never interfere with references. Templates without references never invokeop.type: secretservices can usestringData(plaintext, one value per line), which is base64 encoded intodatawithin the compiled manifest, just as Kubernetes expects.op whoami(only when references are present) and halts with a friendlyeval $(op signin)message otherwise.0600and removed after they've been applied (c kc start,c kc apply), or whenc skaffold devexits (newc kc secrets-cleancommand, quiet via-q). This only applies to the local environment; beta and production are unaffected (they will move to Google Secret Manager).c skaffold devnow halts when manifest compilation fails, rather than continuing into skaffold with stale compiled manifests.Verification and testing
Verification
manifests/local/site.secret.yaml) held base64 (i.e. plaintext) secret values committed to git:base64 -don any value reveals it.Testing
eval $(op signin)in the shell,c kc manifestscompiles secret templates into.compiledwith values identical to the originals (verified 18/18 fields against the previous committed secrets, both in.compiledand applied to the minikube cluster).0600; other compiled manifests remain0644.c kc start/c kc apply, compiled secret manifests are removed; other manifests remain.c skaffold devkeeps them for the session and removes them on exit (including Ctrl+C), via thec kc secrets-clean -qtrap.opsession,c kc manifestsandc skaffold devhalt with a friendly signin message (and skaffold never starts)..yaml.tmplwithout references) render exactly as before; plain.yamlsecrets are still copied verbatim (beta/production/devspace unaffected).Deployment
v6.1.0-beta.1is published to npm (dist-tagbeta) so ras-rsc#449 can pin it while this PR is reviewed. Note: this PR was previously merged prematurely as 1Password secret references for local Kubernetes secret manifests #99 and reset from master; the npm version remains valid (the git tag was removed with the reset).v6.1.0: released from this branch (changelog heading,npm version minor, tagv6.1.0pushed) and published to npm aslatest.