Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: substitution variable format interferes with provider key resolution #104

Open
doodlesbykumbi opened this issue Mar 9, 2019 · 1 comment
Labels

Comments

@doodlesbykumbi
Copy link
Contributor

doodlesbykumbi commented Mar 9, 2019

Currently if a substring in the "secret identifier" is perceived as a substitution variable AND is not declared then Summon throws an error. This has the disastrous effect of preventing providers that accept substrings prepended with $ from ever being run.

This issue follows from @jepperson2's comment at cyberark/summon-aws-secrets#6 (comment)

For example, a secrets.yml like this one fails:

MY_SECRET1: !var fakeSecret#$temp
MY_SECRET2: !var fakeSecret##temp
MY_SECRET3: !var fakeSecret#temp#
MY_SECRET4: !var fakeSecret#te#mp

Because MY_SECRET1 has a '$' in it, it is being parsed as though a corresponding -D temp=... should be passed to the summon command. The error I'm getting is from here: https://github.com/cyberark/summon/blob/master/secretsyml/secretsyml.go#L192

@doodlesbykumbi
Copy link
Contributor Author

doodlesbykumbi commented Mar 9, 2019

Proposal

When the substitution variable has been declared!

$ summon \
 -p /bin/echo \
 -D temp=some_value \
 --yaml 'MY_SECRET1: fakeSecret#$temp' \
 printenv MY_SECRET1
fakeSecret#some_value

Since Summon requires explicit declaration of substitution variables via CLI flags (see above), if there is no declaration then a substring starting with $ isn't a substitution variable.

Current

$ summon \
 -p /bin/echo \
 --yaml 'MY_SECRET1: fakeSecret#$temp' \
 printenv MY_SECRET1
Variable temp not declared!

Proposal

$ summon \
 -p /bin/echo \
 --yaml 'MY_SECRET1: fakeSecret#$temp' \
 printenv MY_SECRET1
fakeSecret#$temp

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

1 participant