argoproj-labs / argocd-vault-plugin

An Argo CD plugin to retrieve secrets from Secret Management tools and inject them into Kubernetes secrets
https://argocd-vault-plugin.readthedocs.io
Apache License 2.0
834 stars 193 forks source link

Prevent injecting binary secrets #680

Open olivergondza opened 1 week ago

olivergondza commented 1 week ago

Is your feature request related to a problem? Please describe.

When data injected from vault are binary, they mess with the syntax of the file they are injected to. The plugin fails with an error that does not quite point out the problem (ex.: "Error: ToYAML: could not export Secret into YAML: error converting JSON to YAML: yaml: control characters are not allowed").

Passing in --verbose-sensitive-output might be cumbersome and unsafe in production.

Describe the solution you'd like

Provided AVP replaces placeholders in plain text files, injecting binary content is an error in all cases. Error out in case the placeholder resolves into a binary content.

Describe alternatives you've considered

Additional context

Used as ArgoCD plugin: kustomize build . | argocd-vault-plugin generate -.