Description

Currently, the only way to pass in yaml formatted input is through the values attribute which will expose any sensitive data through the metadata.values output attribute on the helm_release resource. I desire a similar values_sensitive attribute (like set_sensitive) whose values will be cloaked in any console output (exactly how set_sensitive does so after #480).

My use case is to input sensitive values that are outside of our control (passwords controlled by external parties) through a "secure file" in an Azure Devops pipeline. Secondarily, I want the flexibility to template various other (terraform managed) secrets into a yaml file using the templatefile function (as I find the number of set_sensitive blocks that would be required to be prohibitively time consuming to create and maintain).

Again, while it would be possible to prevent these values from leaking using set_sensitive, when building enterprise software with many secrets (at varying depths in the yaml values structure) this becomes prohibitively complex and time consuming.

Also, I am willing to give implementing this a shot (would be my first contribution using Go, but seems pretty straightforward).

Potential Terraform Configuration

resource "helm_release" "example" {
  name  = "example"
  chart = "example"

  values = [
<<-EOT
notSecret: "not-a-secret-value"
EOT
]

/* 
any keys used in this section will not be leaked in plan/apply through
the output metadata.values or the values_sensitive attribute itself
*/
values_sensitive = [
file("secureFile.yaml"), /* beware, contains secrets */
templatefile("values.template.yaml", { super_secret = var.super_secret }),
<<-EOT
mySecret: "${ var.super_secret_value }"
maybeASecret: "${ var.maybe_not_secret_value }"
EOT
]
}

References

#480 (I am suggesting a new attribute that is a combination of functionality offered through set_sensitive and the existing values attributes)
#340 (Rejected in favor of 480)

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment