Method DecryptSecret

pkg/helmexec/exec.go:251–348

(context HelmContext, name string, flags ...string)

}

func (helm *execer) DecryptSecret(context HelmContext, name string, flags ...string) (string, error) {
	absPath, err := filepath.Abs(name)
	if err != nil {
		return "", err
	}

	helm.logger.Debugf("Preparing to decrypt secret %v", absPath)
	helm.decryptedSecretMutex.Lock()

	secret, ok := helm.decryptedSecrets[absPath]

	// Cache miss
	if !ok {

		secret = &decryptedSecret{}
		helm.decryptedSecrets[absPath] = secret

		secret.mutex.Lock()
		defer secret.mutex.Unlock()
		helm.decryptedSecretMutex.Unlock()

		helm.logger.Infof("Decrypting secret %v", absPath)
		preArgs := context.GetTillerlessArgs(helm)
		env := context.getTillerlessEnv()
		out, err := helm.exec(append(append(preArgs, "secrets", "dec", absPath), flags...), env)
		helm.info(out)
		if err != nil {
			secret.err = err
			return "", err
		}

		// HELM_SECRETS_DEC_SUFFIX is used by the helm-secrets plugin to define the output file
		decSuffix := os.Getenv("HELM_SECRETS_DEC_SUFFIX")
		if len(decSuffix) == 0 {
			decSuffix = ".yaml.dec"
		}

		// helm secrets replaces the extension with its suffix ONLY when the extension is ".yaml"
		var decFilename string
		if strings.HasSuffix(absPath, ".yaml") {
			decFilename = strings.Replace(absPath, ".yaml", decSuffix, 1)
		} else {
			decFilename = absPath + decSuffix
		}

		secretBytes, err := ioutil.ReadFile(decFilename)
		if err != nil {
			secret.err = err
			return "", err
		}
		secret.bytes = secretBytes

		if err := os.Remove(decFilename); err != nil {
			return "", err
		}

	} else {
		// Cache hit