Skip to content

Fix #1464: Store set_sensitive values separately from computed values to prevent leakage in plan output - #1847

Open
dennismdejong wants to merge 1 commit into
hashicorp:mainfrom
dennismdejong:fix/1464-set-sensitive-leak
Open

Fix #1464: Store set_sensitive values separately from computed values to prevent leakage in plan output#1847
dennismdejong wants to merge 1 commit into
hashicorp:mainfrom
dennismdejong:fix/1464-set-sensitive-leak

Conversation

@dennismdejong

Copy link
Copy Markdown

When set_sensitive values are used and any other value changes, the plan output previously leaked the full content of the sensitive values in plaintext in the values section of the plan output.

Root cause: set_sensitive values were merged into the base values map via getValues(), and the merged result (including sensitive content) was stored in the computed metadata.values field via setReleaseAttributes. Since metadata.values is not marked sensitive, the entire merged values (including sensitive content) appeared in plan output when a diff occurred.

Fix:

  • Added getNonSensitiveValues() that processes only non-sensitive inputs (values, set, set_list), excluding set_sensitive
  • Modified setReleaseAttributes to build metadata.values from non-sensitive inputs only
  • The full merge (including set_sensitive) still happens at apply time via getValues() when actually running helm install/upgrade
  • Updated the TestAccResourceRelease_cloakValues test to expect empty metadata.values since sensitive values are no longer stored there

…ed values to prevent leakage in plan output
@dennismdejong
dennismdejong requested review from a team, iam404 and rigalGit as code owners July 27, 2026 19:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant