terraform-controller
terraform-controller copied to clipboard
Sensitive outputs should not be stored in configuration status
When a configuration status is written outputs from the Terraform plan are written to the status section under outputs. In my example the output value is marked 'sensitive = true' so its value is not shown in Terraform logs. However, the configuration status outputs shows the value in plaintext. This value should be obscured in the outputs section, similar to how Terraform displays it in logs, so the value may only be retrieved from kubernetes secrets.
To reproduce: define an output with 'sensitive = true'. View outputs after applying the plan.