[Synthetics] Store SHA 256 hash of certificates in state instead of the actual cert #835
Conversation
| StateFunc: func(val interface{}) string { | ||
| return convertToSha256(val.(string)) | ||
| }, |
There was a problem hiding this comment.
Won't this make terraform hash the value twice ? once in the read function when you use getCertificateStateValue, and once by terraform automatically when you set the value in the state ?
There was a problem hiding this comment.
Well actually, from my testing, it seems this doesn't do anything at all, let's just remove it and manually set the hashed value directly.
There was a problem hiding this comment.
No this function never receives a hashed value (I've checked by printing it).
| if configCertificateContent, ok := d.GetOk("request_client_certificate.0.cert.0.content"); ok { | ||
| localCertificate["cert"][0]["content"] = configCertificateContent.(string) | ||
| localCertificate["cert"][0]["content"] = getCertificateStateValue(configCertificateContent.(string)) |
There was a problem hiding this comment.
I think GetOk takes the value from the config, not the state, so it should never be hashed already. Unless I'm missing something, there should be no need to do this, and instead rely on the StateFunc you added above to let terraform store in the state no ?
There was a problem hiding this comment.
I thought so as well, but when I print the value to debug, we get a hashed value (even after commenting the StateFunc). I assumed it is when terraform reads the config to compare the state and the config.
There was a problem hiding this comment.
Yeah looks like depending on when you call it, it picks from state or from config...
|
Well ignore all I said... terraform does too many weird things, what you have seems to be working fine, so let's go for it. |
zippolyte
changed the title
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Do not store the content of client certificate in the state file for privacy.
Note: When this is released, it will trigger a non empty plan for every user with certificates in their config