terraform-google-alloy-db icon indicating copy to clipboard operation
terraform-google-alloy-db copied to clipboard

fix: set cluster output to sensitive

Open valeriopoggi opened this issue 6 months ago • 7 comments

Mark the cluster output as sensitive, as this causes errors in e.g. terragrunt when setting the cluster_initial_user:

│ Error: Output refers to sensitive values
│ 
│   on outputs.tf line 63:
│   63: output "cluster" {
│ 
│ To reduce the risk of accidentally exporting sensitive data that was
│ intended to be only internal, Terraform requires that any root module
│ output containing sensitive data be explicitly marked as sensitive, to
│ confirm your intent.
│ 
│ If you do intend to export this data, annotate the output value as
│ sensitive by adding the following argument:
│     sensitive = true

valeriopoggi avatar May 27 '25 15:05 valeriopoggi

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

google-cla[bot] avatar May 27 '25 15:05 google-cla[bot]

@valeriopoggi can you can make it sensitive in your root module?

imrannayer avatar May 29 '25 16:05 imrannayer

We’re also blocked by this issue and hope to proceed once the fix is merged

roman-povoroznyk avatar Jun 16 '25 09:06 roman-povoroznyk

@roman-povoroznyk can you set it to sensitive in your code where you are calling module?

imrannayer avatar Jun 16 '25 15:06 imrannayer

@imrannayer Sorry for the delayed reply, I've been away the past two weeks

That isn't possible for us, we are using the module directly via Terragrunt. The issue arises only when setting cluster_initial_user parameter

valeriopoggi avatar Jun 16 '25 16:06 valeriopoggi

Hi @imrannayer

Looks like this output is intended for use as a wait for cluster creation? An option might be to either use a specific field, or remove the sensitive fields, or even squash to a bool, rather than return the entire resource.google_alloydb_cluster.default. That way it would no longer be marked as sensitive.

output "cluster" {
  description = "Cluster created"
  value       = resource.google_alloydb_cluster.default
}

apeabody avatar Jun 16 '25 21:06 apeabody

Any updates???

Zasimovich avatar Jun 18 '25 12:06 Zasimovich