-
-
Notifications
You must be signed in to change notification settings - Fork 758
Disallow decrypt_kv jinja filter for fields marked as secret for pack config #4709
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Disallow decrypt_kv jinja filter for fields marked as secret for pack config #4709
Conversation
Here is the sample output for
|
Here is the output for
|
This commit addresses the issue where in pack config if fields are marked as secret: true and if user specifies jinja expression with filter decrypt_kv, the values are decrypted twice. This is due to the fact that for all fields marked as secret, the values are auto decrypted. Specifying an additional decrypt_kv filter causes issue. The commit raises exceptions if decrypt_kv is specified for any fields marked secret.
cc863c8
to
5634bfb
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Where are the unit test(s)? Is this cover elsewhere? If so, please identify.
eabc4a9
to
d514dbf
Compare
This commit updates the error message shown to the user and also adds unit testcase to check for exception when decrypt_kv filter is specified for field marked as `secret: True`
d514dbf
to
f7b4636
Compare
ed4fb3a
to
2a00552
Compare
…ue of the schema PR #4709
st2tests/st2tests/fixtures/packs/dummy_pack_22/config.schema.yaml
Outdated
Show resolved
Hide resolved
@VineeshJain Please remove |
9d86548
to
70d190a
Compare
@VineeshJain You still need to fix the titles for the earlier commits. |
I know, I am not done yet. |
70d190a
to
97c503c
Compare
b44d83a
to
719bddd
Compare
This PR addresses the issue where in pack config if fields are marked as secret: true and if user specifies jinja expression with filter decrypt_kv, the values are decrypted twice. This is due to the fact that for all fields marked as secret, the values are auto decrypted. Specifying an additional decrypt_kv filter causes issue.
The fix is to raise exceptions if decrypt_kv is specified for any fields marked secret. This is done for all three
st2 pack config
, Pack config from the WebUI and forst2ctl reload --reload-configs