Support safe diagnostics for sensitive Package Values

Open
  • Is something wrong?
#5,658 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
49/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
go, helm, kubernetes
Domain
backend, security

Research direction

Start by tracing package deployment through packager.DeployOptions and the Helm value processing and logging paths; the issue does not name specific files or tests. Check how YAML parsing failures and Helm values conflicts reach logs and errors, then add credential-canary coverage for both cases. Done means sensitive value contents are omitted while useful diagnostics remain.

Written by the indexing model from the issue text.

Description

Is your feature request related to a problem? Please describe.

Package Values have no sensitivity metadata. YAML errors can include rendered values, and Helm coalescing warnings can expose them outside Zarf's context logger.

UDS CLI PR #1638 suppresses backend logging when sensitive values are present. This loses useful diagnostics without preventing every disclosure.

Describe the behavior you'd like
  • Given sensitive Package Values,
  • When deploying a package,
  • Then omit their contents from logs and errors while retaining useful diagnostics.

A proposed deployment option keeps value.Values unchanged:

opts := packager.DeployOptions{
    Values: value.Values{
        "registry": map[string]any{
            "password": "credential-canary",
        },
    },
    SensitiveValues: true,
}

SensitiveValues would omit value contents from deployment logs and errors while preserving useful diagnostics. This field is proposed, not currently supported.

Describe alternatives you've considered
  • Sensitive deployment variables: chart mappings extract plain values, losing sensitivity before Helm. Current upstream also rejects SetVariables for v1beta1 packages.
  • ValuesOverridesMap: still produces plain Helm values; no additional protection.
  • Context logger filtering: Helm's action logger already uses it, but coalescing warnings bypass it through global logging. String replacement also misses transformed values.
  • Post-render variable substitution: can avoid exposing credentials during Helm value merging, but requires package changes and changes chart behavior.
Additional context

Please cover YAML parsing failures and Helm values conflicts with credential-canary tests.

Related: https://github.com/defenseunicorns/uds-cli/pull/1638

Dominant language
Go
Stars
2.1k
Forks
281
Avg merge
3d 2h
Merged PRs (30d)
79

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from zarf-dev/zarf

All issues in zarf-dev/zarf

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.