summon
summon copied to clipboard
fix: substitution variable format interferes with provider key resolution
Currently if a substring in the "secret identifier" is perceived as a substitution variable AND is not declared then Summon throws an error. This has the disastrous effect of preventing providers that accept substrings prepended with $
from ever being run.
This issue follows from @jepperson2's comment at https://github.com/cyberark/summon-aws-secrets/issues/6#issuecomment-470661844
For example, a secrets.yml like this one fails:
MY_SECRET1: !var fakeSecret#$temp MY_SECRET2: !var fakeSecret##temp MY_SECRET3: !var fakeSecret#temp# MY_SECRET4: !var fakeSecret#te#mp
Because MY_SECRET1 has a '$' in it, it is being parsed as though a corresponding
-D temp=...
should be passed to the summon command. The error I'm getting is from here: https://github.com/cyberark/summon/blob/master/secretsyml/secretsyml.go#L192
Proposal
When the substitution variable has been declared!
$ summon \
-p /bin/echo \
-D temp=some_value \
--yaml 'MY_SECRET1: fakeSecret#$temp' \
printenv MY_SECRET1
fakeSecret#some_value
Since Summon requires explicit declaration of substitution variables via CLI flags (see above), if there is no declaration then a substring starting with $ isn't a substitution variable.
Current
$ summon \
-p /bin/echo \
--yaml 'MY_SECRET1: fakeSecret#$temp' \
printenv MY_SECRET1
Variable temp not declared!
Proposal
$ summon \
-p /bin/echo \
--yaml 'MY_SECRET1: fakeSecret#$temp' \
printenv MY_SECRET1
fakeSecret#$temp