Flux CLI support for parameters from env vars (at least sensitive ones such as password)

[canidam]

Bootstrapping flux with git subcommand using credentials requires the user to provide password over CLI.

  # Run bootstrap for a Git repository and authenticate using a password
  flux bootstrap git --url=https://example.com/repository.git --password=<password>

This is a bad pattern. I find it weird flux doesn't support provide credentials over environment variables or from a file.

Couple of problems with such pattern:

1. Password is kept in history by default (unless user remembers to start with the command with a space)
2. Other users on the machine can read the password in clear-text with ps -aux

Why does the flux CLI doesn't support variables from the environment? Is that something worth opening a PR for?

[kingdonb]

There are some ways you can configure your shell to avoid keeping sensitive history, but that doesn't really get at the meat of what you're asking...

The flux bootstrap github and flux bootstrap gitlab commands can both take their credential (the GITHUB_TOKEN or GITLAB_TOKEN) from either: an environment variable, an input at runtime (hidden / using a password prompt that does not echo characters)

I'm sure this is just an oversight in the flux bootstrap git command. If you want to submit a PR that follows the example in other bootstraps, where a missing password gets an interactive prompt presented, and hides the terminal echo for password input, I'm sure that's something we'd be interested in merging. The option of an environment variable also makes sense, given the others provide similar functionality.

I'm not sure what git providers still permit password authentication and don't require SSH authorization (it's not permitted anymore on GitHub, afaik), but the generic git bootstrap should work with everything including GitHub and GitLab as well as others, and I believe the lack of elaborate password entry capacity here is not an intentional slight or design decision, just an oversight/missing feature.

[kingdonb]

We also added a feature so that if you omit GITHUB_TOKEN, the CLI will prompt in a password input (no echo) so that you can enter the value without creating any footprint in the process tree or environment.

There appears to have been added a GIT_PASSWORD variable added in response to the issue that you raised:

https://fluxcd.io/docs/cmd/flux_bootstrap_git/#examples