Can porter explain include the sensitive property?

[tamirkamara]

Hi,

We use the explain command a lot and miss the ability to know if a parameter is defined as sensitive.
Does that option exist?

[carolynvs]

You aren't the first to point out that we are missing sensitive in explain! Out of curiosity, how does whether or not a parameter is sensitive impact your workflows? Do you do anything different because a param is sensitive? I'm asking in case there's more that we can do to help, beyond adding in the extra info to explain.

[carolynvs]

How does something like this look? This would also change the other output formats (yaml/json) so that if you are using explain to automate, you can get at the sensitive flag there too.

EDIT: I've created #2228 to track adding sensitive to the yaml/json output for porter explain. I decided to not edit the human readable output (below) because this is just for automation.

$ porter explain -r ghcr.io/getporter/examples/credentials-tutorial:v0.3.0
Name: examples/credentials-tutorial
Description: An example Porter bundle with credentials. Uses your GitHub token to retrieve your public user profile from GitHub.
Version: 0.3.0
Porter Version: v1.0.0-alpha.19

Credentials:
--------------------------------------------------------------------------------
  Name          Description                          Required  Applies To
--------------------------------------------------------------------------------
  github-token  A GitHub Personal Access             true      install,upgrade
                Token. Generate one at
                https://github.com/settings/tokens.
                No scopes are required.

Parameters:
------------------------------------------------------------------------------------
  Name  Description                     Type    Default  Required  Sensitive  Applies To
------------------------------------------------------------------------------------
  user  A GitHub username. Defaults to  string           false     true        install,upgrade
        the current user.

This bundle uses the following tools: exec.

To install this bundle run the following command, passing --param KEY=VALUE for any parameters you want to customize:
porter credentials generate mycreds --reference ghcr.io/getporter/examples/credentials-tutorial:v0.3.0
porter install --reference ghcr.io/getporter/examples/credentials-tutorial:v0.3.0 --cred mycreds

[tamirkamara]

I see it's on the v1 version...
Is the same available in 0.38?

[carolynvs]

I'm hoping you can help me out by providing a bit more context about why having sensitive printed in the explain output is helpful?

Out of curiosity, how does whether or not a parameter is sensitive impact your workflows? Do you do anything different because a param is sensitive? I'm asking in case there's more that we can do to help, beyond adding in the extra info to explain.

[tamirkamara]

We have a system/automation that deploys bundles on demand. That requires us to know which parameters a bundle requires and supply the values when we call upon it.
Naturally we have a way to retrieve those values which are persisted into a store we manage. However, when it comes to a secret we'd like to manage its value differently (like via key vault), but for that we need to know it's one to begin with.
Many aspects of our automation depend on information we retrieve from the explain output, so knowing if a param is sensitive will come in handy.

[carolynvs]

Quick question, is the explain commands output working well for that or would it be easier to be able to extract the entire porter.yaml file from the bundle reference and then you'd have all the metadata you need?

We have been thinking of adding flags to the inspect command to help people get at either the porter.yaml or the bundle.json so that they can get all the available metadata about a bundle:

$ porter inspect -r MYBUNDLE --porter-manifest
name: mybundle
 
mixins:
- helm3
- exec
# rest of the bundle's porter.yaml

$ porter inspect -r MYBUNDLE --cnab-manifest
{
  "name": "mybundle"
  "custom": {
    "sh.porter": {
       "mixins": { ... }
   }
  }
}

[tamirkamara]

I think it works well, but we anyway output it as json and process the results so having the raw porter.yaml might not be much of a difference...

[carolynvs]

Thank you for taking the time to help me get a bit more context into the problem. 🙇‍♀️ I've created #2228 to track adding sensitive to the yaml/json output for porter explain.