fix(vault-secrets): vault_infra_token modifiable par le role - #1077
Open
Baran-Aksoy wants to merge 1 commit into
Open
fix(vault-secrets): vault_infra_token modifiable par le role#1077Baran-Aksoy wants to merge 1 commit into
Baran-Aksoy wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issues liées
Issues numéro: 1076
Quel est le comportement actuel ?
Si vault_infra_token est écrit vide dans Vault une fois (par exemple à cause d'un problème de timing au premier run), plus aucun re-run du playbook ne peut le corriger, même quand la vraie valeur est correctement calculée sur les runs suivants.
Cause : le merge yq '.old *n .new' dans roles/gitops/vault-secrets/tasks/write.yml ne remplace jamais une clé déjà présente côté old, même si sa valeur est une chaîne vide "".
Quel est le nouveau comportement ?
vault_infra_token est supprimé du côté old avant le merge (del(.vault_infra_token)), donc traité comme une clé absente et toujours remplie avec la valeur fraîchement calculée côté new. Les autres clés/secrets gardent leur comportement de protection habituel, inchangé.
Cette PR introduit-elle un breaking change ?
Non.
Autres informations
RAS.