diff --git a/helm/resource_release.go b/helm/resource_release.go index 75e1934b82..f67ebc0147 100644 --- a/helm/resource_release.go +++ b/helm/resource_release.go @@ -875,13 +875,35 @@ func cloakSetValues(config map[string]interface{}, d resourceGetter) { const sensitiveContentValue = "(sensitive value)" +func tokenizeCloakElements(valuePath string) []string { + var res []string + beginSubstr, endSubstr := 0, 0 + + for idx := range valuePath { + if (valuePath[idx] == '.') && (idx > 0) { + if valuePath[idx-1] != '\\' { + res = append(res, valuePath[beginSubstr:endSubstr]) + beginSubstr = endSubstr + 1 + } + } + endSubstr++ + } + + if endSubstr-beginSubstr > 0 { + res = append(res, valuePath[beginSubstr:]) + } + + return res +} + func cloakSetValue(values map[string]interface{}, valuePath string) { - pathKeys := strings.Split(valuePath, ".") + pathKeys := tokenizeCloakElements(valuePath) sensitiveKey := pathKeys[len(pathKeys)-1] parentPathKeys := pathKeys[:len(pathKeys)-1] m := values for _, key := range parentPathKeys { + key = strings.ReplaceAll(key, "\\", "") v, ok := m[key].(map[string]interface{}) if !ok { return @@ -889,6 +911,7 @@ func cloakSetValue(values map[string]interface{}, valuePath string) { m = v } + sensitiveKey = strings.ReplaceAll(sensitiveKey, "\\", "") m[sensitiveKey] = sensitiveContentValue } diff --git a/helm/resource_release_test.go b/helm/resource_release_test.go index aaad63fdf3..0e56fa309d 100644 --- a/helm/resource_release_test.go +++ b/helm/resource_release_test.go @@ -750,14 +750,14 @@ func TestCloakSetValues(t *testing.T) { func TestCloakSetValuesNested(t *testing.T) { d := resourceRelease().Data(nil) err := d.Set("set_sensitive", []interface{}{ - map[string]interface{}{"name": "foo.qux.bar", "value": "42"}, + map[string]interface{}{"name": "foo.qux.bar\\.nested", "value": "42"}, }) if err != nil { t.Fatalf("error setting values: %v", err) } qux := map[string]interface{}{ - "bar": "bar", + "bar.nested": "bar", } values := map[string]interface{}{ @@ -767,8 +767,8 @@ func TestCloakSetValuesNested(t *testing.T) { } cloakSetValues(values, d) - if qux["bar"] != sensitiveContentValue { - t.Fatalf("error cloak values, expected %q, got %s", sensitiveContentValue, qux["bar"]) + if qux["bar.nested"] != sensitiveContentValue { + t.Fatalf("error cloak values, expected %q, got %s", sensitiveContentValue, qux["bar.nested"]) } }