feat: wildcard for fetching all secrets by matryxxx02 · Pull Request #247 · hashicorp/vault-action

matryxxx02 · 2021-08-26T15:53:12Z

fixes #234

This PR allows the use of * (wildcard) to fetch all secrets into env variables.

Example Usage

example of secrets :

{
 ci : {
   aws : {
     URL_API : {
        "http://localhost:3000"
     }
   }
 }
}

jobs:
    build:
        # ...
        steps:
            # ...
            - name: Import Secrets
              uses: hashicorp/vault-action@v2.3.1
              with:
                url: https://vault.mycompany.com:8200
                token: ${{ secrets.VaultToken }}
                caCertificate: ${{ secrets.VAULTCA }}
                secrets: |
                    secret/data/ci/aws *
            # ...
           - name : Test secret
              run: echo "Hello ${{env.URL_API}}"

hashicorp-cla · 2021-08-26T15:53:16Z

All committers have signed the CLA.

src/secrets.js

Co-authored-by: Brian Woodward <brian.woodward@gmail.com>

slemme1 · 2021-10-11T19:48:45Z

When will this be resolved to get this code merged?

slemme1 · 2021-10-11T19:49:19Z

When will this get resolved to get this code merged?

bfaulk96 · 2021-11-12T21:07:32Z

This would be great!

bfaulk96 · 2021-11-23T21:17:09Z

@matryxxx02 any chance you could resolve those merge conflicts?

…to feat/wildcard-all-secrets � Conflicts: � package-lock.json

bfaulk96 · 2021-11-23T21:42:39Z

Dang, that was fast!! @doowb What are the chances of this landing in the next release?

ElenaForester · 2021-12-22T17:28:57Z

Eagerly waiting for this to be released 🙏

karlanuetzel · 2021-12-29T14:33:54Z

+1 on this landing in next release

ndrader · 2022-01-20T03:38:25Z

Any news on this getting merged? Would love to use it.

ElenaForester · 2022-01-25T23:16:54Z

Any news on this getting merged? Would love to use it.

I figured out that for now you can use

secrets: |
                    secret/data/ci/aws $.$

Marcanta · 2022-02-08T09:22:54Z

Any news on this getting merged? Would love to use it.

I figured out that for now you can use
secrets: |
                    secret/data/ci/aws $.$

I agree, however, it's annoying to use...

      - name: Import env.TEST from vault
        uses: hashicorp/vault-action@v2.3.0
        with:
          url: http://127.0.0.1:8200
          tlsSkipVerify: true
          token: ${{ secrets.VAULT_TOKEN }}
          secrets: |
              secret/data/test $.$ | TEST
              
      - name : echo env
        run: echo "Hello ${{env.TEST.HELLO_WORLD}}"

It would be great if we could drop the TEST.

karlanuetzel · 2022-08-26T20:47:55Z

Any update on this?

bfaulk96 · 2022-10-13T19:42:59Z

Currently going on 1 year, 47 days, 21 hours, 50 minutes since this great PR was created and subsequently ignored.

heatherezell · 2022-10-13T22:32:43Z

Currently going on 1 year, 47 days, 21 hours, 50 minutes since this great PR was created and subsequently ignored.

You're right, and you have my apologies as well as my thanks for resurfacing this. I'll have our engineering team take a look. :)

bfaulk96 · 2022-10-14T13:18:38Z

@hsimon-hashicorp Well, the as the old adage goes, "Better late than never". Thank you for looking into this! 😄

bfaulk96 · 2022-10-14T13:20:01Z

@matryxxx02 looks like there are once again a few merge conflicts, if you have time to address them

…ecrets # Conflicts: # package-lock.json # src/action.js

brewgator

Good work so far, just a couple possible issues I noticed. Thank you for sticking with this, I do think that this is a good feature we would want to include.

brewgator · 2023-01-19T16:18:43Z

dist/index.js

-        selector = "data." + selector
-        body = JSON.parse(body)
-        if (body.data["data"] != undefined) {
+


Can you remove the changes here? dist/index.js is generated upon release, so we don't need to include any files in the dist/ directory.

brewgator · 2023-01-19T17:05:04Z

src/secrets.js

-        body = JSON.parse(body)
-        if (body.data["data"] != undefined) {
+
+        let value;


I believe we will need to pull out the JSON parse and move it here so body is parsed in both conditional branches.

brewgator · 2023-01-19T17:29:43Z

src/action.js

 const AUTH_METHODS = ['approle', 'token', 'github', 'jwt', 'kubernetes'];
 const ENCODING_TYPES = ['base64', 'hex', 'utf8'];

+function addMask(value) {


I think moving this to its own function is a good idea, however it seems to cause some issues with the acceptance tests

~$ npm run test > vault-action@0.1.0 test > jest PASS src/auth.test.js FAIL src/action.test.js ● exportSecrets › single-line secret gets masked expect(jest.fn()).toBeCalledTimes(expected) Expected number of calls: 1 Received number of calls: 2 334 | await exportSecrets(); 335 | > 336 | expect(command.issue).toBeCalledTimes(1); | ^ 337 | 338 | expect(command.issue).toBeCalledWith('add-mask', 'secret'); 339 | expect(core.setOutput).toBeCalledWith('key', 'secret'); at Object.toBeCalledTimes (src/action.test.js:336:31) ● exportSecrets › multi-line secret gets masked for each line expect(jest.fn()).toBeCalledTimes(expected) Expected number of calls: 2 Received number of calls: 4 354 | await exportSecrets(); 355 | > 356 | expect(command.issue).toBeCalledTimes(2); // 1 for each non-empty line. | ^ 357 | 358 | expect(command.issue).toBeCalledWith('add-mask', 'a multi-line string'); 359 | expect(command.issue).toBeCalledWith('add-mask', 'with blank lines'); at Object.toBeCalledTimes (src/action.test.js:356:31) ::add-mask::value ::add-mask::value PASS src/retries.test.js Test Suites: 1 failed, 2 passed, 3 total Tests: 2 failed, 27 passed, 29 total Snapshots: 0 total Time: 2.532 s, estimated 3 s Ran all test suites. ::add-mask::value ::add-mask::value

maxcoulombe · 2023-09-15T13:37:16Z

Hey everyone, thanks for showing interest in this feature. I'm happy to report that an equivalent implementation was recently merged in #488 . I'll close this PR for now as the functionality implemented appears equivalent.

The wildcard selector feature should be available in an up-coming v2.8.0 release, cheers!

matryxxx02 and others added 3 commits August 26, 2021 11:45

add * wildcard for fetch all secrets

c2dbbf6

add * wildcard for fetch all secrets

5ab26dd

Update action.yml

89c2697

matryxxx02 changed the title ~~feat: wildcard for fetching all secrets (#234)~~ feat: wildcard for fetching all secrets Aug 26, 2021

doowb reviewed Aug 27, 2021

View reviewed changes

src/secrets.js Outdated Show resolved Hide resolved

Check the data property in secrets.js

78c0110

Co-authored-by: Brian Woodward <brian.woodward@gmail.com>

matryxxx02 and others added 3 commits November 23, 2021 22:23

resolve package lock

5bfb7d7

Merge branch 'master' of https://github.com/hashicorp/vault-action in…

1e3275a

…to feat/wildcard-all-secrets � Conflicts: � package-lock.json

resolve conflict

05adbc9

brewgator mentioned this pull request Jan 18, 2023

Issue234 Import all keys from specific path #238

Closed

Merge remote-tracking branch 'upstream/main' into feat/wildcard-all-s…

0add1c8

…ecrets # Conflicts: # package-lock.json # src/action.js

matryxxx02 requested a review from doowb January 19, 2023 00:45

brewgator requested changes Jan 19, 2023

View reviewed changes

brewgator reviewed Jan 19, 2023

View reviewed changes

maxcoulombe closed this Sep 15, 2023

Conversation

matryxxx02 commented Aug 26, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Example Usage

Uh oh!

hashicorp-cla commented Aug 26, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

slemme1 commented Oct 11, 2021

Uh oh!

slemme1 commented Oct 11, 2021

Uh oh!

bfaulk96 commented Nov 12, 2021

Uh oh!

bfaulk96 commented Nov 23, 2021

Uh oh!

bfaulk96 commented Nov 23, 2021

Uh oh!

ElenaForester commented Dec 22, 2021

Uh oh!

karlanuetzel commented Dec 29, 2021

Uh oh!

ndrader commented Jan 20, 2022

Uh oh!

ElenaForester commented Jan 25, 2022

Uh oh!

Marcanta commented Feb 8, 2022

Uh oh!

karlanuetzel commented Aug 26, 2022

Uh oh!

bfaulk96 commented Oct 13, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

heatherezell commented Oct 13, 2022

Uh oh!

bfaulk96 commented Oct 14, 2022

Uh oh!

bfaulk96 commented Oct 14, 2022

Uh oh!

brewgator left a comment

Choose a reason for hiding this comment

Uh oh!

brewgator Jan 19, 2023

Choose a reason for hiding this comment

Uh oh!

brewgator Jan 19, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

brewgator Jan 19, 2023

Choose a reason for hiding this comment

Uh oh!

maxcoulombe commented Sep 15, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

matryxxx02 commented Aug 26, 2021 •

edited

Loading

hashicorp-cla commented Aug 26, 2021 •

edited

Loading

bfaulk96 commented Oct 13, 2022 •

edited

Loading

brewgator Jan 19, 2023 •

edited

Loading