Shared secret files #12
Conversation
Summary of ChangesHello @PhennyOpsta, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request implements a new feature that enhances secret management within Helm charts by allowing users to define and mount multiple files from a single Kubernetes secret. This provides greater flexibility and organization for applications requiring granular secret access, simplifying configuration and improving maintainability. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new feature sharedSecretFiles to mount multiple files from a single secret. While the implementation is largely correct, it's critical to address a YAML injection vulnerability where user-provided values are injected into Helm templates without proper quoting or sanitization. Furthermore, a bug in _volumesRef.yaml can create duplicate volume definitions, potentially leading to invalid Kubernetes manifests. There are also opportunities to improve code readability by simplifying Helm template or conditions and clarifying descriptions in values.schema.json.
| - name: {{ .name }} | ||
| secret: | ||
| secretName: {{ .name }} |
There was a problem hiding this comment.
The value .name is used directly in the YAML template without quotes, which could lead to YAML injection vulnerabilities if an attacker controls the input. Quoting these values ensures they are treated as strings by the YAML parser. Additionally, this loop can create duplicate volume definitions if the .Values.sharedSecretFiles list contains multiple entries with the same secret name, resulting in an invalid Kubernetes manifest.
- name: {{ .name | quote }}
secret:
secretName: {{ .name | quote }}| - name: {{ $secretName }} | ||
| mountPath: {{ .mountPath }} | ||
| {{- if .subPath}} | ||
| subPath: {{ .subPath }} |
There was a problem hiding this comment.
The values $secretName, .mountPath, and .subPath are injected into the YAML template without quotes. This can lead to YAML injection if these values contain newlines or other control characters. It is a security best practice to quote string values in Helm templates to prevent such issues.
- name: {{ $secretName | quote }}
mountPath: {{ .mountPath | quote }}
{{- if .subPath}}
subPath: {{ .subPath | quote }}| @@ -1,5 +1,5 @@ | |||
| {{- define "common.volumeMountsRef.tpl" -}} | |||
| {{- if or (or (or (.Values.volumes) (.Values.sealedFileSecrets)) .Values.fileSecrets) .Values.existingFileSecrets -}} | |||
| {{- if or (or (or (or (.Values.volumes) (.Values.sealedFileSecrets)) .Values.fileSecrets) .Values.existingFileSecrets) .Values.sharedSecretFiles -}} | |||
There was a problem hiding this comment.
The nested or conditions can be simplified into a single or with multiple arguments. This improves readability and makes the code easier to maintain.
{{- if or .Values.volumes .Values.sealedFileSecrets .Values.fileSecrets .Values.existingFileSecrets .Values.sharedSecretFiles -}}| @@ -1,5 +1,5 @@ | |||
| {{- define "common.volumesRef.tpl" }} | |||
| {{- if or (or (or (.Values.volumes) (.Values.sealedFileSecrets)) .Values.fileSecrets) .Values.existingFileSecrets }} | |||
| {{- if or (or (or (or (.Values.volumes) (.Values.sealedFileSecrets)) .Values.fileSecrets) .Values.existingFileSecrets) .Values.sharedSecretFiles}} | |||
There was a problem hiding this comment.
The nested or conditions can be simplified into a single or with multiple arguments. This improves readability and makes the code easier to maintain.
{{- if or .Values.volumes .Values.sealedFileSecrets .Values.fileSecrets .Values.existingFileSecrets .Values.sharedSecretFiles}}| value: | ||
| - name: my-existing-secret | ||
| secret: | ||
| secretName: my-existing-secret |
There was a problem hiding this comment.
It would be beneficial to add a test case that verifies the behavior when sharedSecretFiles contains multiple entries for the same secret name. This ensures that duplicate volumes are not created, which would otherwise result in an invalid manifest. This test will help validate the fix for the issue in _volumesRef.yaml.
secretName: my-existing-secret
- it: Should handle duplicate secret names correctly
set:
sharedSecretFiles:
- name: my-existing-secret
files:
- mountPath: /config/a
subPath: a.txt
- name: my-existing-secret
files:
- mountPath: /config/b
subPath: b.txt
asserts:
- template: deployment.yaml
documentIndex: 0
equal:
path: spec.template.spec.volumes
value:
- name: my-existing-secret
secret:
secretName: my-existing-secret
- template: deployment.yaml
documentIndex: 0
isSubset:
path: spec.template.spec.containers[0].volumeMounts
content:
- mountPath: /config/a
name: my-existing-secret
subPath: a.txt
readOnly: true
- mountPath: /config/b
name: my-existing-secret
subPath: b.txt
readOnly: true| "subPath": { | ||
| "type": "string", | ||
| "title": "SubPath", | ||
| "description": "Optional file inside the secret to mount (mounts entire secret if omitted)" |
There was a problem hiding this comment.
The description for subPath could be more precise. When subPath is omitted, all keys in the secret are mounted as files, not the entire secret as a single file. Clarifying this will help users understand the behavior better.
| "description": "Optional file inside the secret to mount (mounts entire secret if omitted)" | |
| "description": "The key of the secret to mount. If not specified, all keys from the secret will be mounted as files in the directory specified by `mountPath`." |
2 participants
feat: This feature allows multiple secret files to be shared using a single secret name.