By default hide values in KVM

[peruzzof]

Currently I am using apigeecli in my CI/CD pipeline, one of the steps is to update the KVM "secrets". In my current scenario I believe that the values in KVM should be hidden by default. I believe that the best approach is a flag when we need to show the value of entries during the create/delete. But a flag to hide them will work as well in my scenario.

Could you check if this makes sense?

[srinandan]

This is a control plane feature (or a feature of the API) and best captured via a support case.

Personally, I don't think such a flag is helpful. It a user or service account has the ability to create/delete a KVM, they should be allow the see the values. This principle also applies to GCP Secret Manager.

[peruzzof]

The issue here is that the user performing the action is a service account, but the logs are kept and being showed in our release process (Azure DevOps) that many users have access, so the assumption that who is seeing the result has the proper permission doesnt apply to this scenario.

So what I am proposing is a flag to hide the sensitive value both in the create and delete KVM entries. In my opinion this best fit the presentation layer (apigeecli) and not the control plane. Anyway I am opening a support case to implement an "update entry" as we have only the create and delete operations, so I will add the request.

Just to clarify, currently I am hiding using "jq" in the script that calls apigeecli, but if we got any error (eg: the credential expired) I will not be able to see the details as jq will complain about the unexpected format.

[srinandan]

oh I see what you mean. That is fair. I will add a flag to control the output.

[srinandan]

Can you please try: https://github.com/apigee/apigeecli/releases/tag/v1.113.1-beta

There is a new global flag --no-output=true. This suppresses API responses for that command.

[ssvaidyanathan]

@srinandan - what if there was an error? will it suppress the response?

[srinandan]

No, errors (404, 403 etc.) are still printed as-is from the control plane. I will clarify this in the help command.

[peruzzof]

I just tested the beta release and is working as expected.
Thanks for the great work!

[srinandan]

This is now available with v1.113