Adds the ability to specify a custom location for your credentials

oliverturner commented 7 years ago

This PR provides a sample pattern for adding extra config for plugins under the custom config key:

custom:
  pluginConfig:
    secrets: 
      localPath: 'foo/bar'
    pluginName: 
      key1: val
      key2: val

It also consolidates the logic for calculating paths to secrets and encrypted files into a single function for the sake of consistency.

oliverturner commented 7 years ago

Unfortunately this approach doesn't work in the common case that one runs serverless decrypt -s {stage} -p pass on a supplied secrets.{stage}.yml.encrypted file. My guess is that this is because references in the plugin to serverless.yml cause it to get parsed and validated in advance of the secrets file being created: any properties dependent on this file will cause an error to be thrown.

Example:

Given an encrypted file at ./tools/serverless/secrets.dev.yml.encrypted

And a serverless.yml containing

custom:
pluginConfig:
secrets:
  localPath: "./tools/serverless"
secrets: ${file(${self:custom.pluginConfig.secrets.localPath}/secrets.${opt:stage}.yml)}

Calling serverless decrypt -s dev -p 'mypassword' results in

Serverless Warning --------------------------------------

 A valid file to satisfy the declaration 'file(./tools/serverless/secrets.dev.yml)'
 could not be found.

Possible fixes

Use an argument to the cli instead (annoying: wd be required on every operation)
Pass a flag that prevents the validation

nikgraf commented 7 years ago

Do I understand correctly that this requirements was covered with https://github.com/serverless/serverless-secrets-plugin/pull/2

btw I released a new version of the plugin on NPM today

oliverturner commented 7 years ago

I think so... I'll let you know if not!

Thanks for the update 👍

serverless / serverless-secrets-plugin

Adds the ability to specify a custom location for your credentials #4

Example:

Possible fixes