sarex/terraform-contour-mirror
1
0
Fork 0
mirror of https://gitlab.sarex.io/infra/terraform-contour-mirror.git synced 2026-08-05 18:31:00 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

++ guard secrets/vault key typo at env top-level in contour terragrunt.hcl

Browse Source
This commit is contained in:
Kochetkov S 2026-08-05 10:10:58 +03:00
parent 631375d53f
commit b54fc6f29b
2 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
live/secrets/terragrunt.hcl
View File

@ -35,6 +35,17 @@ locals {
secret_values_env = local.secret_values_config.environments[local.env_name]
# A typo in the "secrets" key itself (e.g. "secretz") opens the same hole
# as the per-entry typos below: try() on the secrets line below can't tell
# "key absent because 0 secrets declared" from "key renamed by a typo" -
# both yield []. Explicitly validate the env's allowed top-level keys.
allowed_secret_env_keys = toset(["secrets", "vault"])
secret_env_key_typos = [
for k in keys(local.secret_values_env) : "env '${local.env_name}': unknown top-level key '${k}'"
if !contains(local.allowed_secret_env_keys, k)
]
_fail_on_secret_env_key_typos = length(local.secret_env_key_typos) > 0 ? file("Unknown/misspelled top-level key(s) in infrastructure-secrets.yaml: ${join(" | ", local.secret_env_key_typos)}") : ""
# secrets key itself may legitimately be absent for an environment with 0
# secrets declared - that one stays a real default, not an error.
secrets = try(local.secret_values_env.secrets, [])

14
live/vault-secrets/terragrunt.hcl
View File

@ -34,7 +34,19 @@ locals {
# ошибки terraform "no such file".
_fail_on_missing_secret_env = !contains(keys(local.secrets_config.environments), local.env_name) ? file("INFRA_ENV '${local.env_name}' not found in infrastructure-secrets.yaml environments: [${join(", ", keys(local.secrets_config.environments))}]") : ""
env_config = local.secrets_config.environments[local.env_name]
env_config = local.secrets_config.environments[local.env_name]
# Опечатка в самом ключе "vault" (например "vaultt") даёт ту же дыру, что
# и провалившийся decrypt: try() ниже не отличит "vault осознанно не задан"
# от "ключ переименован опечаткой" - в обоих случаях vault_config = {} и
# план "нечего менять в vault" выглядит легитимно.
allowed_env_config_keys = toset(["secrets", "vault"])
env_config_key_typos = [
for k in keys(local.env_config) : "env '${local.env_name}': unknown top-level key '${k}'"
if !contains(local.allowed_env_config_keys, k)
]
_fail_on_env_config_key_typos = length(local.env_config_key_typos) > 0 ? file("Unknown/misspelled top-level key(s) in infrastructure-secrets.yaml: ${join(" | ", local.env_config_key_typos)}") : ""
vault_config = try(local.env_config.vault, {})
vault_enabled = try(local.vault_config.enabled, false)
}