sensitive function seems to be ignored for kubernetes_manifest

[papanito]

Terraform version, Kubernetes provider version and Kubernetes version

Terraform v1.4.5
on windows_amd64
+ provider registry.terraform.io/gavinbunney/kubectl v1.14.0
+ provider registry.terraform.io/hashicorp/helm v2.9.0
+ provider registry.terraform.io/hashicorp/kubernetes v2.19.0
+ provider registry.terraform.io/rancher/rancher2 v2.0.0

Question

I have this kubernetes_manifest object

resource "kubernetes_manifest" "trust-certificates" {
  manifest = {
    "apiVersion" = "v1"
    "kind"       = "Secret"
    "metadata" = {
      "name"      = "certificates"
      "namespace" = var.namespace
    }
    "data" = {
        "ca-certificates.crt" = sensitive(file("${path.module}/certificate.pem"))
    }
  }
}

I marked the data as sensitive cause I don't want it to shown in the plan. However it still shows up

tf plan
...
VzWmhTWm5jcUE0U052dEo4d0RuK0liajBLNm1XQlQ4MGFxUTNCaEszZ2o0VGd4Wgp2ckJLWUpWRnBub1kweEZmYTBFaWhJTjBRZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
            }
          + kind       = "Secret"
          + metadata   = {
              + name      = "certificates"
              + namespace = "cert-manager"
            }
        }
    }

Plan: 1 to add, 4 to change, 0 to destroy.

What am I doing wrong? is this a bug?

[spirkaa]

Same problem. Terraform 1.3.9 redacts output, but not 1.4.x

[arybolovlev]

Hi @papanito,

This is expected behavior to see a sensitive value as a plain text under the object. That happens because Terraform doesn't carry the sensitive attribute in the returned tftype object. However, it should be hidden under the manifest.

As @spirkaa has mentioned, starting from 1.4.0 we observe a change in the behavior of displaying sensitive values. They are now visible under the manifest too. That happens only for the kubernetes_manifest resource.

We are going to investigate this.

Thank you.

[papanito]

However, it should be hidden under the manifest.

how so?

[alexsomesan]

This looks like a regression in Terraform itself. Will raise it with the team to get it evaluated.

[liamcervante]

I've ported this over to the Terraform core repository: https://github.com/hashicorp/terraform/issues/33056.

I think this issue could be closed, and we can track from the new issue.

[alexsomesan]

Thanks for porting it over to TF, @liamcervante I would lean on keeping this one open until the fix is merged on your side, just to avoid duplicates in case other people run into this and come to report it.

[papanito]

Seems the issue was fixed on 24th of April, so we can also close my issue right? @alexsomesan

[primeroz]

i am having this problem on with terraform 1.3.9

in the manifest section the value is marked as sensitive but in the object section is not

i am using kubernetes_manifest to push an argocd application

          "values" = yamlencode({
            "test" = {
              "enabled"    = false,
              "fakeSecret" = sensitive("password"),
            }
          })

in plan

manifest

+                       values                  = (sensitive value)

object

+                       values                  = <<-EOT
                            "test":
                              "enabled": false
                              "fakeSecret": "password"
                        EOT
+                       valuesObject            = (known after apply)
+                       version                 = (known after apply)
                    }

[benjefferies]

i am having this problem on with terraform 1.3.9

in the manifest section the value is marked as sensitive but in the object section is not

i am using kubernetes_manifest to push an argocd application

          "values" = yamlencode({
            "test" = {
              "enabled"    = false,
              "fakeSecret" = sensitive("password"),
            }
          })

in plan

manifest

+                       values                  = (sensitive value)

object

+                       values                  = <<-EOT
                            "test":
                              "enabled": false
                              "fakeSecret": "password"
                        EOT
+                       valuesObject            = (known after apply)
+                       version                 = (known after apply)
                    }

I'm doing the exact same thing to inject some values that are sensitive into the application of an argocd application. Did you find any work around @primeroz. I am playing around with ignoring the object section as I do not need the values for anything

[primeroz]

No i did not ... fortunately for me we don't really have any real secret in those manifests anymore so is not a big problem ... but as part of due diligence i tested that and noticed the problem