Fixing Deployment Secrets - Plaintext in Inputs

[IaroslavTitov]

Note: there is an alternative implementation of this PR - #320

Summary

• Added logic to save ciphertext into the output properties for secret values, allowing comparison on refresh of just ciphertext, fixing Refresh on Deployment Settings always shows a diff if there are secrets #123
• Import now works as well, including code generation (with dummy values for secrets)
• Migrated to new PUT API and updated client to actually return DeploymentSettings

Testing

• Tested pulumi up, refresh, import and up from previous version of the provider (for unchanged DS inputs, migrating to this new way of saving will require refresh and then up)

Example TS program (Sadly can't use Dotnet, due to bug with maps):

const settings = new service.DeploymentSettings("deployment_settings", {
  organization: "IaroslavTitov",
  project: "PulumiDotnet",
  stack: "SdkTest5",
  operationContext: {
    environmentVariables: {
      TEST_VAR: "fooa",
      SECRET_VAR: config.requireSecret("my_secret"),
    }
  },
  sourceContext: {
    git: {
        repoUrl: "https://github.com/pulumi/deploy-demos.git",
        branch: "refs/heads/main",
        repoDir: "pulumi-programs/simple-resource",
        gitAuth: {
            sshAuth: {
                sshPrivateKey: "privatekey",
                password: secret,
            }
        }
    }
}
});

Secret resource values end up with just cipher, while plaintext is stored in inputs:

      "sshAuth": {
        "password": "AAABAD6/2Nroj62qORoHOLofFOkRhdUNwCAYeC86nABU/G4AO5I7Fw==",
        "sshPrivateKey": "AAABABqRIQ1bZbvU/hrlpX1Rh9sj9OCyArjG0SUILPQmb0KSCFIrz6bK"
      }

Passwords and sshKey are forced into twin secrets, Environment Variables are optionally twin secrets, everything else uses normal Pulumi workflows, because they are not secret in Pulumi Service.

Import of the above code generates successfully with dummy values for secrets:

const ds1 = new pulumiservice.DeploymentSettings("ds1", {
    operationContext: {
        environmentVariables: {
            SECRET_VAR: pulumi.secret("<REPLACE WITH ACTUAL SECRET VALUE>"),
            TEST_VAR: "fooa",
        },
    },
    organization: "IaroslavTitov",
    project: "PulumiDotnet",
    sourceContext: {
        git: {
            branch: "refs/heads/main",
            gitAuth: {
                sshAuth: {
                    password: pulumi.secret("<REPLACE WITH ACTUAL SECRET VALUE>"),
                    sshPrivateKey: pulumi.secret("<REPLACE WITH ACTUAL SECRET VALUE>"),
                },
            },
            repoDir: "pulumi-programs/simple-resource",
            repoUrl: "https://github.com/pulumi/deploy-demos.git",
        },
    },
    stack: "SdkTest5",
}, {
    protect: true,
});

[komalali]

Is this guaranteed to exist? What happens if plaintextInputSettings.SourceContext.Git.GitAuth.SSHAuth is nil?

[IaroslavTitov]

Yes, if a value in plaintextInputSettings exists, it also exists in plaintextInputSettings, because they are retrieved from inputs and outputs of the current state

[komalali]

I'm guessing you meant "if a value in currentStateCipherSettings exists, it also exists in plaintextInputSettings"?

[IaroslavTitov]

Ah, yes, sorry!