Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: set sensitive for gh-runner-gke ca_certificate output #196

Conversation

cjonesy
Copy link
Contributor

@cjonesy cjonesy commented Oct 15, 2024

The gh-runner-gke module depends on terraform-google-kubernetes-engine/beta-private-cluster and passes through some of it's outputs. However the ca_certificate output is not properly tagged as sensitive = true to match it's upstream counterpart here.

This PR correctly sets the ca_certificate output as sensitive.

This becomes problematic when using the module from Terragrunt as you'll get the following error:

╷
│ Error: Output refers to sensitive values
│ 
│   on outputs.tf line 29:
│   29: output "ca_certificate" {
│ 
│ To reduce the risk of accidentally exporting sensitive data that was
│ intended to be only internal, Terraform requires that any root module
│ output containing sensitive data be explicitly marked as sensitive, to
│ confirm your intent.
│ 
│ If you do intend to export this data, annotate the output value as
│ sensitive by adding the following argument:
│     sensitive = true
╵
ERRO[0069] Terraform invocation failed in /Users/cjones/src/terragrunt-repo/development/sandboxes/cjones/scratch/gke-gha/.terragrunt-cache/HaQJoRguUiWbQzqk_oSxpSvldDk/1kW9xrwM9QZFpZ4HlxpmJGveo_g/modules/gh-runner-gke  prefix=[/Users/cjones/src/terragrunt-repo/development/sandboxes/cjones/scratch/gke-gha] 
ERRO[0069] 1 error occurred:
        * [/Users/cjones/src/terragrunt-repo/development/sandboxes/cjones/scratch/gke-gha/.terragrunt-cache/HaQJoRguUiWbQzqk_oSxpSvldDk/1kW9xrwM9QZFpZ4HlxpmJGveo_g/modules/gh-runner-gke] exit status 1

@cjonesy cjonesy requested review from gtsorbo and a team as code owners October 15, 2024 21:18
Copy link

google-cla bot commented Oct 15, 2024

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

The gh-runner-gke module depends on terraform-google-kubernetes-engine/beta-private-cluster
and passes through some of it's outputs. However the `ca_certificate` output is not
properly tagged as sensitive = true to match it's upstream counterpart.

This commit correctly sets the ca_certificate output as sensitive.
@cjonesy cjonesy force-pushed the fix-sensitive-output-ca-cert branch from 8b5dfdb to a546da7 Compare October 15, 2024 21:23
@cjonesy cjonesy changed the title Set sensitive for gh-runner-gke ca_certificate output fix: set sensitive for gh-runner-gke ca_certificate output Oct 15, 2024
@bharathkkb
Copy link
Member

/gcbrun

Copy link
Member

@bharathkkb bharathkkb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR @cjonesy

@bharathkkb bharathkkb enabled auto-merge (squash) November 5, 2024 16:22
@apeabody
Copy link
Contributor

apeabody commented Nov 5, 2024

/gcbrun

@bharathkkb bharathkkb merged commit 5367df3 into terraform-google-modules:master Nov 5, 2024
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants