Conversation
dipti-pai
force-pushed
the
extend-sops-redaction-to-postbuild
branch
from
September 11, 2026 16:54
088f579 to
a107437
Compare
matheuscscp
reviewed
Sep 11, 2026
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
Member
|
@dipti-pai Looks like the agent still implemented this in a way that the data is being loaded twice |
dipti-pai
force-pushed
the
extend-sops-redaction-to-postbuild
branch
from
September 14, 2026 21:07
a107437 to
bf0485b
Compare
postBuild.substituteFrom values are substituted verbatim into manifests before server-side apply. When the resulting value causes a Kubernetes API validation error that echoes the value back (e.g. a label value over the 63 byte limit), the raw error was copied unmodified into the Kustomization status conditions and events. Register a collector via generator.ContextWithSecretVarsCollector on the context passed to r.build(), which captures the postBuild.substituteFrom Secret-sourced values already loaded internally by generator.SubstituteVariables (via generator.LoadVariables) while building manifests, and mask those values out of apply errors before they are attached to the Ready condition or emitted as an event. ConfigMap-sourced substituteFrom values and inline postBuild.substitute values are intentionally excluded from redaction, since they are not expected to hold sensitive data. This extends the existing SOPS decryption error redaction (safeDecrypt) to also cover postBuild substitutions, without an additional ConfigMap/Secret fetch beyond what r.build() already performs. go.mod TEMPORARILY replaces github.com/fluxcd/pkg/kustomize with a branch on github.com/dipti-pai/pkg that adds ContextWithSecretVarsCollector (fluxcd/pkg@main...dipti-pai:pkg:kustomize-substitute-with-vars). This must be swapped for a tagged github.com/fluxcd/pkg/kustomize release once that change is reviewed and merged upstream. Signed-off-by: Dipti Pai <diptipai89@outlook.com> Assisted-by: GitHub Copilot/Claude Sonnet 5
dipti-pai
force-pushed
the
extend-sops-redaction-to-postbuild
branch
from
September 14, 2026 22:30
bf0485b to
7bf79fe
Compare
Member
Author
Hi @matheuscscp. Had to update pkg code to avoid the additional call to Could you take a look? Thanks. |
Member
|
Thanks @dipti-pai, I merged pkg 1298. I will cut a |
Member
Author
Thanks @matheuscscp : ) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
postBuild.substituteFrom values are substituted verbatim into manifests before server-side apply. When the resulting value causes a Kubernetes API validation error that echoes the value back (e.g. a label value over the 63 byte limit), the raw error was copied unmodified into the Kustomization status conditions and events.
Load the postBuild.substituteFrom variables once per reconcile, using the same loader generator.SubstituteVariables relies on internally, and mask their values out of apply errors before they are attached to the Ready condition or emitted as an event. This extends the existing SOPS decryption error redaction (safeDecrypt) to also cover postBuild substitutions.
Assisted-by: GitHub Copilot/Claude Sonnet 5