encrypteAesWithVault template func to retrieve and encrypt
Add a template func encrypteAesWithVault to retrieve the encryption key stored in vault and encypt based on the key
Demo
source
Main task yaml file
scopes:
- name: nonprod
members:
- dev
dvars:
- name: enc_key
value: my_enc_key
flags:
- secret
tasks:
- name: task
task:
- func: cmd
dvars:
- name: value_encrypted
desc: |
encrypteAesWithVault will use the encryption key named enc_key stored in vault to encrypt
it falls back to the normal cached store to get the enc_key if it does not exist
value: '{{ "ENV_AAA" | encrypteAesWithVault "enc_key" }}'
flags:
- vvvv
- taskScope
- name: ENV_AAA
value: '{{.value_encrypted}}'
flags:
- secure
do:
- name: print
cmd: |
var: {{.ENV_AAA}}
decrypted secure var: {{.secure_ENV_AAA}}
- name: inspect
desc: the vars in caller after invoking module task
cmd:
- exec_vars
- exec_base_vars
- exec_base_env_vars_configured
- exec_env_vars_configured
- debug_vars
Main log file
loading [Config]: ./tests/functests/upconfig.yml
Main config:
Version -> 1.0.0
RefDir -> ./tests/functests
WorkDir -> cwd
AbsWorkDir -> /up_project/up
TaskFile -> c0202
Verbose -> vvv
ModuleName -> self
ShellType -> /bin/sh
MaxCallLayers -> 8
Timeout -> 3600000
MaxModuelCallLayers -> 256
EntryTask -> task
ModRepoUsernameRef ->
ModRepoPasswordRef ->
work dir: /up_project/up
-exec task: task
loading [Task]: ./tests/functests/c0202
module: [self], instance id: [dev], exec profile: []
profile - envVars:
(*core.Cache)({
})
Task1: [task ==> task: ]
-Step1:
dvar> value_encrypted:
"qOtQF6MM+rZbDl1+VFk7zYjtMkH0veIlMLxnQsTuzdk="
-
qOtQF6MM+rZbDl1+VFk7zYjtMkH0veIlMLxnQsTuzdk=
self: final context exec vars:
(*core.Cache)({
"value_encrypted": "qOtQF6MM+rZbDl1+VFk7zYjtMkH0veIlMLxnQsTuzdk=",
"up_runtime_task_layer_number": 0,
"ENV_AAA": "qOtQF6MM+rZbDl1+VFk7zYjtMkH0veIlMLxnQsTuzdk="
})
~SubStep1: [print: ]
var: qOtQF6MM+rZbDl1+VFk7zYjtMkH0veIlMLxnQsTuzdk=
decrypted secure var: ENV_AAA
~SubStep2: [inspect: the vars in caller after invoking module task ]
1: inspect[exec_vars]
(*core.Cache)({
"secure_ENV_AAA": "ENV_AAA",
"value_encrypted": "qOtQF6MM+rZbDl1+VFk7zYjtMkH0veIlMLxnQsTuzdk=",
"up_runtime_task_layer_number": 0,
"ENV_AAA": "qOtQF6MM+rZbDl1+VFk7zYjtMkH0veIlMLxnQsTuzdk="
})
2: inspect[exec_base_vars]
{
}
3: inspect[exec_base_env_vars_configured]
4: inspect[exec_env_vars_configured]
5: inspect[debug_vars]
-debug vars-
"UpRunTimeVars"
(*core.Cache)({
"up_runtime_task_layer_number": 0
})
"RuntimeVarsAndDvarsMerged"
(*core.Cache)({
})
"ExecbaseVars"
(*core.Cache)({
})
"TaskVars"
(*core.Cache)({
"value_encrypted": "qOtQF6MM+rZbDl1+VFk7zYjtMkH0veIlMLxnQsTuzdk="
})
"ExecContextVars"
(*core.Cache)({
"up_runtime_task_layer_number": 0,
"ENV_AAA": "qOtQF6MM+rZbDl1+VFk7zYjtMkH0veIlMLxnQsTuzdk=",
"secure_ENV_AAA": "ENV_AAA",
"value_encrypted": "qOtQF6MM+rZbDl1+VFk7zYjtMkH0veIlMLxnQsTuzdk="
})
--
Logs with different verbose level
Raw logs with different verbose level