Skip to content

fix(vault): trim trailing newlines from kubeconfig before storing in vault add unwrapSOPSData function to handle SOPS data extraction#539

Open
OliverTrautvetter wants to merge 5 commits into
mainfrom
oms_install_k0s_leaves_invalid_vault
Open

fix(vault): trim trailing newlines from kubeconfig before storing in vault add unwrapSOPSData function to handle SOPS data extraction#539
OliverTrautvetter wants to merge 5 commits into
mainfrom
oms_install_k0s_leaves_invalid_vault

Conversation

@OliverTrautvetter

Copy link
Copy Markdown
Member

This pull request introduces several improvements and fixes related to handling kubeconfig storage, SOPS-encrypted vault data, and associated tests. The main changes ensure that kubeconfig files are stored without unwanted trailing newlines, add robust handling for SOPS-encrypted YAML files by unwrapping top-level data wrappers, and enhance testing to validate these behaviors.

Kubeconfig storage improvements:

  • Trailing newlines are now trimmed from the kubeconfig content before storing it in the vault, preventing YAML formatting issues such as the use of |+ chomping.
  • Tests were updated and extended to verify that trailing newlines are properly removed and to ensure the vault file does not contain unwanted YAML formatting.

SOPS/YAML handling improvements:

  • Added the unwrapSOPSData function to automatically strip a top-level data block scalar wrapper from SOPS-encrypted YAML files, ensuring the vault parser receives the intended document structure.
  • Integrated the unwrapping logic into the vault data parser and made the function available for testing.
  • Added comprehensive unit tests for unwrapSOPSData to verify correct behavior with various YAML inputs, including normal, wrapped, and invalid documents.

Clickup

@OliverTrautvetter OliverTrautvetter marked this pull request as ready for review June 29, 2026 12:59
Comment thread internal/installer/export_test.go Outdated
Comment thread internal/installer/vault_encryption.go

@joka134 joka134 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. One simple naming comment

Comment thread internal/installer/vault_encryption_unexported_test.go
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants