Terraform Provider: Kubeconfig as Base64 string #114
Conversation
Accept kubeconfig as base64 string. When configuring the Harvester Terraform provider, the kubeconfig can either be given as path to a file, from which to read, or the contents can be supplied directly as base64 string. This allows for greater flexibility in supplying this sensitive data to the Terraform provider. related-to: harvester/harvester#6234 Signed-off-by: Moritz Röhrich <[email protected]>
|
Are we ok with the cluster user private key ( |
|
This is indeed a concern, but Terraform Enterprise or HCP Terraform are able to encrypt sensitive data before storing it: |
|
If it's up to the user to secure their statefile while using our provider, then I think we should document it somewhere. Normally, a provider would generate sensitive data as an |
|
This would help us with an issue we have getting this to work with Terraform cloud |
|
Looking forward to this as I think this would fix an issue we're encountering |
Document the risk of leaking sensitive information via the Terraform state files when supplying the kubeconfig as base64 encoded string. Signed-off-by: Moritz Röhrich <[email protected]>
|
I've added a warning in the documentation/example that informs the reader of the risk of leaking sensitive information via the Terraform state files. |
| FieldProviderKubeContext = "kubecontext" | ||
| FieldProviderKubeConfig = "kubeconfig" | ||
| FieldProviderKubeContext = "kubecontext" | ||
| FieldProviderKubeConfigBase64 = "kubeconfig_base64" |
There was a problem hiding this comment.
It doesn't look like this is being used.
| @@ -59,3 +68,16 @@ func NewClient(kubeConfig, kubeContext string) (*Client, error) { | |||
| HarvesterNetworkClient: harvNetworkClient, | |||
| }, nil | |||
| } | |||
|
|
|||
| func restConfigFromFile(kubeConfig, kubeContext string) (*rest.Config, error) { | |||
There was a problem hiding this comment.
Will it make sense to move the homedir.Expand(d.Get(constants.FieldProviderKubeConfig).(string)) at
terraform-provider-harvester/internal/provider/provider.go
Lines 71 to 74 in 35e2902
Accept kubeconfig as base64 string.
When configuring the Harvester Terraform provider, the kubeconfig can either be given as path to a file, from which to read, or the contents can be supplied directly as base64 string.
This allows for greater flexibility in supplying this sensitive data to the Terraform provider.
related-to: harvester/harvester#6234