Make secrets available for notification templates

[eroznik]

Summary

I'd like to expose secret data in notification templates, this would have to be done here. I'd suggest we do it similar to what I did on ArgoCD and if needed, we can add a feature flag to include secrets just conditionally.

Use Cases

This was already done on ArgoCD and it is useful to trigger webhooks that require auth data in payloads.

---

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritize the issues with the most 👍.

[oliverkuntze]

Hey,

unfortunately this is not working even in the latest release for webhooks.

Given the following secret:

apiVersion: v1
kind: Secret
metadata:
    name: argo-rollouts-notification-secret
    namespace: argo-rollouts
    labels:
        app.kubernetes.io/part-of: argo-rollouts
stringData:
    webhookurl: ENC[AES256_GCM,data:xa/eLqYLZUjYtfra2IJUr1UczzoUGPxeaTW8Vuo/APqJAg1yFRMMNbSkDMVlRSBThVo6uHjQ/ZEin3qS3PQnduXCyOxGmhMOwosaCyaKlJq/Do1UV1HDTklSN2HjSZLyf9YP3LbO,iv:HTAbIhXyYgHdZYCn0KqU4HIviKsz6WhOYnroYhJ85e0=,tag:UgTc8X0mkpy4FkAEeHfDAw==,type:str]
sops:
...

and the following notification:

...
  template.app-config-webhook: |
    webhook:
      app-config:
        method: POST
        path: $webhookurl
...

I am still getting the following controller log:

[DEBUG] POST https://my.ommitted.gitlab.host/$webhookurl

So $webhookurl is not substituted with the value from the secret.

The MR linked in this issue suggests that the enhancement is included in the latest release.

Any help would be greatly appreciated.

Cheers

Oliver

[oliverkuntze]

@eroznik , @zachaller , do you have any ideas what I am doing wrong?

[oliverkuntze]

OK, I guess I cannot use the secret substitution in templates.
Switched from the gitlab pipeline trigger api to the pipeline api where I can set the access token in the header.
Everything is working as expected now.

[eroznik]

Hey @oliverkuntze , afaik the path template should work.. but you have to use the parameter a bit differently:

  template.app-config-webhook: |
    webhook:
      app-config:
        method: POST
        path: $webhookurl

should be

  template.app-config-webhook: |
    webhook:
      app-config:
        method: POST
        path: `{{ printf "%s" .secrets.webhookurl }}`