fix: resolve secrets in OIDC provider configuration#5153
Conversation
Map values obtained from MapIndex() are non-addressable in Go's reflection API,
preventing secret references from being resolved in the walkConfigForSecrets
function. This fix creates an addressable copy of struct map values, resolves
secrets in the copy, and sets the modified value back into the map.
This enables using ${secret:file:...} syntax in OIDC provider credentials
configuration (client_id and client_secret fields).
Fixes #5131
Signed-off-by: Mark Phelps <[email protected]>
dosubot
Bot
added
the
size:L
|
Related Documentation Checked 4 published document(s) in 1 knowledge base(s). No updates required. How did I do? Any feedback? |
There was a problem hiding this comment.
Pull request overview
This PR fixes secret resolution for OIDC provider credentials stored in map structures. The Go reflection API limitation where map values from MapIndex() are non-addressable prevented the walkConfigForSecrets function from modifying struct values within maps. The fix creates an addressable copy of struct map values, resolves secrets within the copy, and updates the map with the modified value.
- Resolves the addressability issue for struct values in maps by creating addressable copies
- Enables
${secret:file:...}syntax for OIDC providerclient_idandclient_secretfields - Adds comprehensive test coverage for various secret resolution scenarios
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| cmd/flipt/main.go | Added special handling for struct values in maps to create addressable copies before resolving secrets |
| cmd/flipt/main_test.go | Added comprehensive tests covering simple fields, nested structures, maps with struct values, multiple providers, and mixed secret/plain values |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## v2 #5153 +/- ##
==========================================
+ Coverage 60.45% 60.54% +0.09%
==========================================
Files 138 138
Lines 13488 13495 +7
==========================================
+ Hits 8154 8171 +17
+ Misses 4647 4636 -11
- Partials 687 688 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
erka
left a comment
erka
left a comment
There was a problem hiding this comment.
nice
as nit - it would be great to use t.Context()
Co-authored-by: Roman Dmytrenko <[email protected]>
Summary
Map values from
MapIndex()are non-addressable in Go's reflection API, preventing secret references from being resolved in thewalkConfigForSecretsfunction. This fix creates an addressable copy of struct map values, resolves secrets in the copy, and sets the modified value back into the map.This enables using
${secret:file:...}syntax in OIDC provider credentials configuration forclient_idandclient_secretfields.Changes
cmd/flipt/main.go: Fixed map value handling inwalkConfigForSecretsto support secret resolutioncmd/flipt/main_test.go: Added comprehensive tests for secret resolution in various scenariosFixes #5131