Skip to content

Commit 14d56ca

Browse files
authored
Merge pull request #9 from opencredo/tf_lists_maps
Cater for terraform 0.7.x list and map variables
2 parents c386bfb + d096aa7 commit 14d56ca

80 files changed

Lines changed: 5314 additions & 939 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.travis.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
language: go
22
sudo: false
33
go:
4-
- 1.6
4+
- 1.7.3
55
matrix:
66
allow_failures:
77
- go: tip

CHANGELOG.md

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,16 @@
11
## 0.4.2 (Unreleased)
2+
* [PR-9](https://github.com/opencredo/terrahelp/pull/9) Cater for terraform 0.7.x list and map variables (resolves [#8](https://github.com/opencredo/terrahelp/issues/8))
3+
* Updated examples and command line docs
4+
* Builds against Go 1.7.3
5+
* Confirmed testing against Vault 0.5.2
26

37
## 0.4.1
48
* Add new `vault-cli` provider to use the `vault` command line tool rather than talking to the vault API.
59

610
## 0.4.0
711
**Note: This release contains breaking changes!!**
812

9-
Terrahelp will now ignore stdin input if a `-file` flag is present.
10-
11-
**The `-file` flag will no longer default to terraform.tfstate and terraform.tfstate.backup.**
12-
[PR-6](https://github.com/opencredo/terrahelp/pull/6)
13-
14-
This is part of resolving [#5](https://github.com/opencredo/terrahelp/issues/5)
13+
* [PR-6](https://github.com/opencredo/terrahelp/pull/6) Terrahelp will now ignore stdin input if a `-file` flag is present. The `-file` flag will no longer default to terraform.tfstate and terraform.tfstate.backup (part of resolving [#5](https://github.com/opencredo/terrahelp/issues/5))
1514

1615
## 0.3.1
1716

README.md

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -71,25 +71,32 @@ Not here yet ...
7171

7272
To set up your Go environment - look [here](https://golang.org/doc/code.html).
7373

74-
You must have Go > 1.6 installed.
74+
Install Go (Terrahelp is currently built against 1.7.3)
7575

7676
mkdir -p "$GOPATH/src/github.com/opencredo/"
7777
git clone https://github.com/opencredo/terrahelp.git "$GOPATH/src/github.com/opencredo/terrahelp"
7878
cd "$GOPATH/src/github.com/opencredo/terrahelp"
7979

80-
Build it
80+
*Dependencies*
81+
82+
Terrahelp uses [govendor](https://github.com/kardianos/govendor) to manage it's dependencies, and currently also checks them into Git to enable a seamless build experience. However should you wish to change / upgrade any of these, you can get govendor, and then run the appropriate commands (e.g sync, fetch etc)
83+
84+
go get -u github.com/kardianos/govendor
85+
govendor sync
86+
87+
*Build it*
8188

8289
go install
8390

84-
Test it
91+
*Test it*
8592

8693
go test -v ./...
8794

88-
Run it:
95+
*Run it:*
8996

9097
terrahelp -v
9198

92-
Want to cross compile it:
99+
*Want to cross compile it?*
93100

94101
env GOOS=darwin GOARCH=amd64 go build -o=terrahelp-darwin-amd64
95102
env GOOS=linux GOARCH=amd64 go build -o=terrahelp-linux-amd64

commands.go

Lines changed: 74 additions & 68 deletions
Large diffs are not rendered by default.

examples/mask/README.md

Lines changed: 41 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,84 +1,74 @@
11
## Terrahelp example - masking sensitive data
22

3-
This example contains a very simple terraform setup composed entirely of
4-
local resources (e.g. template resource) and exists in order to demonstrate how
5-
you can do masking of sensitive data which may be output from varius terraform
6-
commands.
3+
This example contains a very simple terraform setup composed entirely of local resources (e.g. template resource) and exists in order to demonstrate how you can do masking of sensitive data which may be output from varius terraform commands.
74

8-
This example is completely safe to run and will not land up costing you any
9-
money in a cloud provider!
5+
This example is completely safe to run and will not land up costing you any money in a cloud provider! It currently demonstrates a terraform 0.7.7 based setup which includes the new lists and maps functionality.
106

11-
The CLI itself offers a more comprehensive view of the various options available,
12-
so please use this if you need more info.
7+
The CLI itself offers a more comprehensive view of the various options available, so please use this if you need more info.
138

149
### Simple inline masking of terraform output
1510

16-
This example will demonstrate how you can use the `mask` command in order to mask
17-
sensitive data which may be exposed when performing terraform actions.
11+
This example will demonstrate how you can use the `mask` command in order to mask sensitive data which may be exposed when performing terraform actions.
1812

1913
* Run a `terraform plan` as normal
2014

2115
terraform plan
2216
2317
* Inspect the result which should look something like below:
2418

25-
Refreshing Terraform state prior to plan...
19+
Refreshing Terraform state in-memory prior to plan...
20+
The refreshed state will be used to calculate this plan, but
21+
will not be persisted to local or remote state storage.
2622

27-
The Terraform execution plan has been generated and is shown below.
28-
Resources are shown in alphabetical order for quick scanning. Green resources
29-
will be created (or destroyed and then created if an existing resource
30-
exists), yellow resources are being changed in-place, and red resources
31-
will be destroyed.
23+
...
3224

33-
Note: You didn't specify an "-out" parameter to save this plan, so when
34-
"apply" is called, Terraform can't guarantee this is what will execute.
25+
<= data.template_file.example
26+
rendered: "<computed>"
27+
template: "\nmsg1 = ${msg1}\nmsg2 = ${msg2}\nmsg3 = ${msg3}\nmsg4 = ${msg4}\nmsg5 = ${msg5}\nmsg6 = ${msg6}\nmsg7 = ${msg7}"
28+
vars.%: "7"
29+
vars.msg1: "sensitive-value-1-AK#%DJGHS*G"
30+
vars.msg2: "normal value 1"
31+
vars.msg3: "sensitive-value-3-//dfhs//"
32+
vars.msg4: "sensitive-value-4 with equals sign i.e. ff=yy"
33+
vars.msg5: "sensitive-list-val-1"
34+
vars.msg6: "sensitive-flatmap-val-foo"
35+
vars.msg7: "sensitive-flatmap-val"
3536

36-
+ template_file.example
37-
rendered: "" => "<computed>"
38-
template: "" => "\nmsg1 = ${msg1}\nmsg2 = ${msg2}\nmsg3 = ${msg3}"
39-
vars.#: "" => "3"
40-
vars.msg1: "" => "sensitive-value-1-AK#%DJGHS*G"
41-
vars.msg2: "" => "normal value 1"
42-
vars.msg3: "" => "sensitive-value-3-//dfhs//"
4337

44-
45-
Plan: 1 to add, 0 to change, 0 to destroy.
38+
Plan: 0 to add, 0 to change, 0 to destroy.
39+
40+
4641

4742
* Run the same command, but pipe the output through the `terrahelp mask` command.
4843

4944
terraform plan | terrahelp mask
5045

5146
* The result should now look something like below:
5247

53-
Refreshing Terraform state prior to plan...
48+
Refreshing Terraform state in-memory prior to plan...
49+
The refreshed state will be used to calculate this plan, but
50+
will not be persisted to local or remote state storage.
5451
52+
...
5553
56-
The Terraform execution plan has been generated and is shown below.
57-
Resources are shown in alphabetical order for quick scanning. Green resources
58-
will be created (or destroyed and then created if an existing resource
59-
exists), yellow resources are being changed in-place, and red resources
60-
will be destroyed.
61-
62-
Note: You didn't specify an "-out" parameter to save this plan, so when
63-
"apply" is called, Terraform can't guarantee this is what will execute.
64-
65-
+ template_file.example
66-
rendered: "" => "<computed>"
67-
template: "" => "\nmsg1 = ${msg1}\nmsg2 = ${msg2}\nmsg3 = ${msg3}"
68-
vars.#: "" => "3"
69-
vars.msg1: "" => "******"
70-
vars.msg2: "" => "normal value 1"
71-
vars.msg3: "" => "******"
54+
<= data.template_file.example
55+
rendered: "<computed>"
56+
template: "\nmsg1 = ${msg1}\nmsg2 = ${msg2}\nmsg3 = ${msg3}\nmsg4 = ${msg4}\nmsg5 = ${msg5}\nmsg6 = ${msg6}\nmsg7 = ${msg7}"
57+
vars.%: "7"
58+
vars.msg1: "******"
59+
vars.msg2: "normal value 1"
60+
vars.msg3: "******"
61+
vars.msg4: "******"
62+
vars.msg5: "******"
63+
vars.msg6: "******"
64+
vars.msg7: "******"
7265
7366
74-
Plan: 1 to add, 0 to change, 0 to destroy.
67+
Plan: 0 to add, 0 to change, 0 to destroy.
7568

76-
To change the mask character and/or length, you can use the `-maskchar` and `-numchars`
77-
flags, e.g. `terraform plan | terrahelp mask -maskchar=# -numchars=3`
69+
To change the mask character and/or length, you can use the `-maskchar` and `-numchars` flags, e.g. `terraform plan | terrahelp mask -maskchar=# -numchars=3`
7870

79-
By default, the mask command will also attempt to detect whether any previous sensitive data
80-
may be exposed, and if so will mask this as well. This may happen for example when changing the
81-
value of one sensitive value to another e.g.
71+
By default, the mask command will also attempt to detect whether any previous sensitive data may be exposed, and if so will mask this as well. This may happen for example when changing the value of one sensitive value to another e.g.
8272

8373
+ template_file.example
8474
rendered: "" => "<computed>"
@@ -101,6 +91,5 @@ In which case the resulting mask will look as follows
10191
If you want to suppress this default behaviour you can use the `-prev=false`
10292

10393
### How does it work out what is considered sensitive?
104-
At present, `terrahelp` relies on using the `terraform.tfvars` file as the mechanism to
105-
indicate which values should be considered sensitive, and thus masked out when detected.
94+
At present, `terrahelp` relies on using the `terraform.tfvars` file as the mechanism to indicate which values should be considered sensitive, and thus masked out when detected.
10695

examples/mask/terraform.tf

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,27 @@
1-
# Something basic
1+
# -------------------------------------------------
2+
# Example terraform file based on 0.7.7
3+
# -------------------------------------------------
24
provider "aws" {
35
access_key = "${var.pretend_aws_access_key}"
46
secret_key = "${var.pretend_aws_secret_key}"
57
region = "us-east-1"
68
}
79

8-
resource "template_file" "example" {
9-
template = "\nmsg1 = ${msg1}\nmsg2 = ${msg2}\nmsg3 = ${msg3}"
10+
data "template_file" "example" {
11+
template = "\nmsg1 = ${msg1}\nmsg2 = ${msg2}\nmsg3 = ${msg3}\nmsg4 = ${msg4}\nmsg5 = ${msg5}\nmsg6 = ${msg6}\nmsg7 = ${msg7}"
1012
vars {
1113
msg1 = "${var.tf_sensitive_key_1}"
1214
msg2 = "${var.tf_normal_key_1}"
1315
msg3 = "${var.tf_sensitive_key_3}"
16+
msg4 = "${var.tf_sensitive_key_4}"
17+
msg5 = "${var.tf_sensitive_list_vals[0]}"
18+
msg6 = "${var.tf_sensitive_flatmap_vals["foo"]}"
19+
msg7 = "${var.tf_sensitive_flatmap_vals["overlap"]}"
1420
}
1521
}
1622

1723
output "rendered" {
18-
value = "${template_file.example.rendered}"
24+
value = "${data.template_file.example.rendered}"
1925
}
2026

2127
output "normal_val_2" {

examples/mask/terraform.tfvars

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
1-
# ------------------------------------------------------------------
2-
# NOTE: terraform.tfvars should ordinarily NEVER be checked into
3-
# version control. This file is only here because it is
4-
# part of demonstrating sample functionality, it does not
5-
# actually contain anything sensitive.
6-
# -------------------------------------------------------------------
1+
# -------------------------------------------------
2+
# Example terraform.tfvars file based on 0.7.7
3+
# Note: this is only for testing / example purposes
4+
# this file should NEVER really be checked into
5+
# version control
6+
# -------------------------------------------------
7+
# Some comment
78
pretend_aws_access_key = "madeup-aws-access-key-PEJFNS"
89
pretend_aws_secret_key = "madeup-aws-secret-key-KGSDGH"
910
tf_sensitive_key_1 = "sensitive-value-1-AK#%DJGHS*G"
@@ -14,3 +15,17 @@ tf_sensitive_key_3 = "sensitive-value-3-//dfhs//"
1415
tf_sensitive_key_4 = "sensitive-value-4 with equals sign i.e. ff=yy"
1516
# tf_sensitive_key_5 = "encrypted-value-5"
1617
tf_sensitive_key_6 = "sensitive-value-6"
18+
19+
# new list and maps (terraform 0.7.x and higher)
20+
tf_sensitive_list_vals = [
21+
"sensitive-list-val-1",
22+
"sensitive-list-val-2",
23+
"sensitive-list-val"
24+
]
25+
26+
tf_sensitive_flatmap_vals = {
27+
foo = "sensitive-flatmap-val-foo"
28+
bax = "sensitive-flatmap-val-bax"
29+
"bob" = "sensitive-flatmap-val-bob"
30+
"overlap" = "sensitive-flatmap-val"
31+
}

examples/mask/variables.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ variable "tf_sensitive_key_3" {}
99
variable "tf_sensitive_key_4" {}
1010
variable "tf_sensitive_key_6" {}
1111

12+
variable "tf_sensitive_list_vals" { type = "list" }
13+
variable "tf_sensitive_flatmap_vals" { type = "map" }
1214

1315
# ----------------------------------------------------------------
1416
# Non sensitive variable defaults

0 commit comments

Comments
 (0)