option to write output to a configmap

[vSivarajah]

Has there been any discussion to enable writing output to a configmap?

We have a usecase where writing the output to configmap would be more beneficial than writing to secret, due to argocd being able to display the values in configmap but not secret for developers.

[chanwit]

hi @vSivarajah thank for for bringing this up!

Outputs may contain sensitive values. That's the main reason why outputs are written to a Secret.
Maybe we need a flag in the spec like allowSensitiveOutputs or something like that?

Let's discuss.

[vSivarajah]

By default we can assume that an output may contain sensitive values and in case you would want to output that to a secret you can instruct it in the Terraform CR. However, in cases where you know that the output is not a senstive value we would rather have it downstreamed to a configmap, because it is a viewable object in Argo GUI for example.

As an example it could be something like this:

writeOutputs:
  - kind: Secret
     name: my-secret
     outputs:
      - my_sensitive_value
  - kind: ConfigMap
     name: my-configmap
     outputs:
     - hello_world

[chanwit]

Yes, the structure makes sense to me. We would do that.
I'm thinking of some good ways to help warn users if they accidentally write some sensitive values to a ConfigMap.

What kind of warning and how would you like to see that message?

[vSivarajah]

Maybe something like this, in a shorter form:

Warning: You are storing sensitive values from an output in Terraform to a Configmap. It is strongly recommended that you avoid outputting sensitive values to a ConfigMap in Kubernetes. Instead, consider using a Kubernetes Secret to store sensitive information 

[binnykmathew]

@chanwit We also have a usecase where we want to output the values to a configMap instead of a Secret. It would also be nice to selectively send some outputs to Secret and others to a ConfigMap.

[chanwit]

Hi @binnykmathew thank you for adding a vote to this feature.