如何在CDKTF输出中隐藏敏感字符串的渲染内容？

问题背景 #

使用CDKTF管理基础设施，通过Helm部署Chart时采用EJS渲染values.yaml文件，执行cdktf deploy或cdktf diff命令时，包含敏感信息的完整values内容会被打印到标准输出，存在数据泄露风险。

可行解决方案 #

方案1：标记敏感字段为Terraform敏感值 #

放弃直接渲染整个YAML字符串，改为在TypeScript中构建结构化的values对象，使用cdktf.sensitive()标记敏感字段，Terraform会自动在diff输出中隐藏这些敏感内容。

修改后的代码示例：

import { Construct } from "constructs";
import { Release } from "../../.gen/providers/helm/release";
import * as cdktf from "cdktf";

export interface VectorConfig {}

export class Atlantis extends Construct {
  constructor(scope: Construct, name: string, _config: VectorConfig) {
    super(scope, name);

    new Release(this, "atlantis", {
      repository: "https://runatlantis.github.io/helm-charts",
      chart: "atlantis",
      name: "atlantis",
      version: "5.4.4",
      values: [
        {
          githubApp: {
            id: 963113,
            installationId: "53537338",
            slug: "atlantis-for-atlantis-goldsky-com",
            secret: cdktf.sensitive(process.env.ATLANTIS_GITHUB_APP_WEBHOOK_SECRET!),
            key: cdktf.sensitive(process.env.ATLANTIS_GITHUB_APP_PRIVATE_KEY!),
          },
          readinessProbe: {
            enabled: true,
            periodSeconds: 5,
            initialDelaySeconds: 5,
            timeoutSeconds: 5,
            successThreshold: 1,
            failureThreshold: 5,
            scheme: "HTTP",
          },
          environment: {
            ATLANTIS_GH_ORG: "goldsky-io",
            ATLANTIS_TFE_TOKEN: cdktf.sensitive(process.env.ATLANTIS_TFE_TOKEN!),
            ATLANTIS_AUTOPLAN_FILE_LIST: "**/*.tf,**/*.tfvars,**/*.tfvars.json,**/cdk.tf.json",
            DOPPLER_TOKEN: cdktf.sensitive(process.env.ATLANTIS_DOPPLER_TOKEN!),
          },
          aws: {
            credentials: cdktf.sensitive(process.env.ATLANTIS_AWS_CREDENTIALS!),
          },
        },
      ],
    });
  }
}

修改后，标记为sensitive()的字段在diff或deploy输出中会被替换为<sensitive>，不会泄露实际敏感数据。

方案2：使用Kubernetes Secret存储敏感数据 #

将敏感信息存储在Kubernetes Secret中，通过Helm的valuesFrom参数引用该Secret，避免敏感数据出现在Terraform状态或输出中。

步骤1：创建Kubernetes Secret资源

import { Secret } from "../../.gen/providers/kubernetes/secret";

// 在Atlantis构造函数内添加
new Secret(this, "atlantis-secrets", {
  metadata: { name: "atlantis-secrets" },
  stringData: {
    "github-app-secret": process.env.ATLANTIS_GITHUB_APP_WEBHOOK_SECRET!,
    "github-app-key": process.env.ATLANTIS_GITHUB_APP_PRIVATE_KEY!,
    "tfe-token": process.env.ATLANTIS_TFE_TOKEN!,
    "doppler-token": process.env.ATLANTIS_DOPPLER_TOKEN!,
    "aws-credentials": process.env.ATLANTIS_AWS_CREDENTIALS!,
  },
});

步骤2：修改Helm Release配置，引用Secret

new Release(this, "atlantis", {
  repository: "https://runatlantis.github.io/helm-charts",
  chart: "atlantis",
  name: "atlantis",
  version: "5.4.4",
  values: [
    {
      githubApp: {
        id: 963113,
        installationId: "53537338",
        slug: "atlantis-for-atlantis-goldsky-com",
      },
      readinessProbe: {
        enabled: true,
        periodSeconds: 5,
        initialDelaySeconds: 5,
        timeoutSeconds: 5,
        successThreshold: 1,
        failureThreshold: 5,
        scheme: "HTTP",
      },
      environment: {
        ATLANTIS_GH_ORG: "goldsky-io",
        ATLANTIS_AUTOPLAN_FILE_LIST: "**/*.tf,**/*.tfvars,**/*.tfvars.json,**/cdk.tf.json",
      },
    },
  ],
  valuesFrom: [
    {
      secretKeyRef: { name: "atlantis-secrets", key: "github-app-secret", optional: false },
      targetPath: "githubApp.secret",
    },
    {
      secretKeyRef: { name: "atlantis-secrets", key: "github-app-key", optional: false },
      targetPath: "githubApp.key",
    },
    {
      secretKeyRef: { name: "atlantis-secrets", key: "tfe-token", optional: false },
      targetPath: "environment.ATLANTIS_TFE_TOKEN",
    },
    {
      secretKeyRef: { name: "atlantis-secrets", key: "doppler-token", optional: false },
      targetPath: "environment.DOPPLER_TOKEN",
    },
    {
      secretKeyRef: { name: "atlantis-secrets", key: "aws-credentials", optional: false },
      targetPath: "aws.credentials",
    },
  ],
});

此方式下，敏感数据仅存储在Kubernetes集群的Secret中，Terraform状态和输出不会包含敏感内容，安全性更高。

方案3：禁用values的diff输出（不推荐） #

若需完全隐藏整个values的diff，可在Helm Release资源中设置lifecycle规则，忽略values字段的变化检测：

new Release(this, "atlantis", {
  repository: "https://runatlantis.github.io/helm-charts",
  chart: "atlantis",
  name: "atlantis",
  version: "5.4.4",
  values: [renderedValues],
  lifecycle: {
    ignoreChanges: ["values"],
  },
});

但该方法会导致Terraform无法检测values的任何变化，可能引发配置漂移，仅适用于特殊场景。

内容的提问来源于stack exchange，提问作者Paymahn Moghadasian