sarex/terraform-contour-mirror
1
0
Fork 0
mirror of https://gitlab.sarex.io/infra/terraform-contour-mirror.git synced 2026-08-05 18:31:00 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

++ fail loudly on decrypt/env-lookup failure and secret key typos instead of silently empty

Browse Source
This commit is contained in:
Kochetkov S 2026-08-04 17:57:22 +03:00
parent 416efa8457
commit 9cde2dcab2
2 changed files with 49 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
live/secrets/terragrunt.hcl
View File

@ -19,13 +19,44 @@ locals {
# decrypted ahead of time and the path is passed via INFRA_SECRET_VALUES_FILE;
# locally we fall back to direct sops decryption. Values reach the module only
# via inputs (ephemeral), never written to disk.
#
# No try(...,"")/try(...,{}) on decrypt/parse/env-lookup below on purpose:
# swallowing those failures used to collapse silently into secrets = [],
# and a terraform plan with 0 declared secrets looks like a normal, boring
# "destroy everything" diff - nothing marks it as "decrypt actually failed".
secret_values_env_file = get_env("INFRA_SECRET_VALUES_FILE", "")
secret_values_raw = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : try(sops_decrypt_file("${local.repo_root}/infrastructure-secrets.yaml"), "")
secret_values_config = try(yamldecode(local.secret_values_raw), {})
secret_values_env = try(local.secret_values_config.environments[local.env_name], {})
secret_values_raw = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : sops_decrypt_file("${local.repo_root}/infrastructure-secrets.yaml")
secret_values_config = yamldecode(local.secret_values_raw)
# file() as a poor man's error(): HCL has no native assert/error function,
# this is the standard trick - an intentionally-broken file() call surfaces
# the message text inside terraform's own "no such file" error.
_fail_on_missing_secret_env = !contains(keys(local.secret_values_config.environments), local.env_name) ? file("INFRA_ENV '${local.env_name}' not found in infrastructure-secrets.yaml environments: [${join(", ", keys(local.secret_values_config.environments))}]") : ""
secret_values_env = local.secret_values_config.environments[local.env_name]
# secrets key itself may legitimately be absent for an environment with 0
# secrets declared - that one stays a real default, not an error.
secrets = try(local.secret_values_env.secrets, [])
# Явная проверка top-level ключей каждой записи secrets: Terraform молча
# отбрасывает незнакомые ключи при приведении к типу (например custom_key
# вместо custom_keys, depends_ons вместо depends_on) - без этой проверки
# опечатка в infrastructure-secrets.yaml тихо теряется, без единой ошибки
# в плане, и нужное поле остаётся дефолтным/пустым.
allowed_secret_keys = toset([
"name", "namespace", "type", "registry_url", "data", "depends_on",
"yc_sa_key_names", "custom_keys", "constant_keys", "random_keys",
"credential_keys", "labels", "annotations", "lifecycle", "sink", "vault_path",
])
secret_key_typos = flatten([
for secret in local.secrets : [
for k in keys(secret) : "${try(secret.namespace, "?")}/${try(secret.name, "?")}: unknown key '${k}'"
if !contains(local.allowed_secret_keys, k)
]
])
_fail_on_secret_key_typos = length(local.secret_key_typos) > 0 ? file("Unknown/misspelled key(s) in infrastructure-secrets.yaml secrets: ${join(" | ", local.secret_key_typos)}") : ""
# image-pull-secret (regcred) fan-out. Single source: vault.data.common.regcred.dockerconfigjson
# (secret values live under vault.data.* - see .sops.yaml encrypted_regex).
# Rolled as a kubernetes.io/dockerconfigjson secret named `regcred` into every

19
live/vault-secrets/terragrunt.hcl
View File

@ -10,20 +10,31 @@ locals {
# В CI файл расшифровывается заранее одним шагом, и путь передаётся через
# INFRA_SECRET_VALUES_FILE (SOPS_AGE_KEY нужен только этому шагу, не всей
# джобе). Локально - fallback на прямую расшифровку через sops_decrypt_file.
#
# Без try(...,"")/try(...,{}) на decrypt/parse ниже намеренно: раньше
# провалившаяся расшифровка тихо схлопывалась в secrets_config = {}, дальше
# в vault_config = {} и vault_enabled = false - план "ничего не менять в
# vault" выглядел бы легитимно, без единой ошибки, хотя причина - сломанный
# ключ/файл, а не осознанное отсутствие vault-конфига.
secret_values_env_file = get_env("INFRA_SECRET_VALUES_FILE", "")
secrets_config_raw = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : try(sops_decrypt_file(local.secrets_file), "")
secrets_config = try(yamldecode(local.secrets_config_raw), {})
secrets_config_raw = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : sops_decrypt_file(local.secrets_file)
secrets_config = yamldecode(local.secrets_config_raw)
env_override = trimspace(get_env("INFRA_ENV", ""))
env_from_file = try(trimspace(local.infra_config.current_environment), "")
available_envs = sort(keys(try(local.secrets_config.environments, {})))
available_envs = sort(keys(local.secrets_config.environments))
env_fallback = try(local.available_envs[0], "")
env_name = local.env_override != "" ? local.env_override : (
local.env_from_file != "" ? local.env_from_file : local.env_fallback
)
env_config = try(local.secrets_config.environments[local.env_name], {})
# file() как самодельный error(): в HCL нет нативного assert/error, это
# стандартный трюк - заведомо не существующий путь всплывает в тексте
# ошибки terraform "no such file".
_fail_on_missing_secret_env = !contains(keys(local.secrets_config.environments), local.env_name) ? file("INFRA_ENV '${local.env_name}' not found in infrastructure-secrets.yaml environments: [${join(", ", keys(local.secrets_config.environments))}]") : ""
env_config = local.secrets_config.environments[local.env_name]
vault_config = try(local.env_config.vault, {})
vault_enabled = try(local.vault_config.enabled, false)
}