fix: mark snapshot agent credentials as sensitive - #171
Open
jonasz-lasut wants to merge 1 commit into
Open
jonasz-lasut wants to merge 1 commit into
jonasz-lasut wants to merge 1 commit into
Conversation
The Terraform schema for vault_raft_snapshot_agent_config declares the cloud storage credentials as plain strings, so the generated SnapshotAgentConfig exposed aws_secret_access_key, aws_session_token, azure_account_key and google_service_account_key as clear-text fields in spec.forProvider and echoed them in status.atProvider. Mark the four attributes sensitive in a resource configurator. The generated API now carries awsSecretAccessKeySecretRef, awsSessionTokenSecretRef, azureAccountKeySecretRef and googleServiceAccountKeySecretRef in spec.forProvider and spec.initProvider, drops the plain fields from spec and status, and the values are read from Kubernetes Secrets at reconcile time. This changes the v1alpha1 schema in place: manifests that set the plain fields must move the value into a Secret and reference it. Storing secrets in clear text in the spec is treated as a bug rather than a supported API, so no new API version is introduced. Fixes upbound#101
jonasz-lasut
marked this pull request as ready for review
September 10, 2026 12:17
jonasz-lasut
requested review from
erhancagirici,
sergenyalcin,
turkenf and
ulucinar
as code owners
September 10, 2026 12:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of your changes
SnapshotAgentConfigexposed the cloud storage credentials ofvault_raft_snapshot_agent_configas plain strings, because the upstream Terraform schema does not mark them sensitive. This adds a resource configurator that setsSensitiveonaws_secret_access_key,aws_session_token,azure_account_keyandgoogle_service_account_key, and regenerates the resource.The generated API now has
awsSecretAccessKeySecretRef,awsSessionTokenSecretRef,azureAccountKeySecretRefandgoogleServiceAccountKeySecretRefinspec.forProviderandspec.initProvider, and the plain fields are gone from spec andstatus.atProvider.This is an in-place change to
v1alpha1: manifests that set the plain fields must move the value into a Secret and reference it. It's a security bugfix which justifies no api version updateFixes #101
I have:
make reviewable testto ensure this PR is ready for review.How has this code been tested
Run
make reviewable test; there is no e2e example for this resource.