🐙 octavia-cli: secret management

[alafanechere]

What

We want secret management to avoid storing credentials as plain text.

How

• Implement a custom YAML loader to expand env variables for node matching regex for string like ${MY_ENV_VAR}
• Change the hashing logic:
  • Rename checksum to hash (because it's a hash and not a checksum...)
  • Compute the hash for a configuration after environment variable expansion. We now compute the hash on the deserialized yaml, not on the yaml file directly.

Recommended reading order

1. octavia-cli/octavia_cli/apply/yaml_loaders.py
2. octavia-cli/unit_tests/test_apply/test_yaml_loaders.py
3. octavia-cli/octavia_cli/apply/resources.py
4. octavia-cli/octavia_cli/templates/source_or_destination.yaml.j2
5. octavia-cli/octavia_cli/generate/renderer.py

🚨 User Impact 🚨

Configuration can use ${MY_ENV_VAR} strings that will be expanded to the environment variable value at run time.

[marcosmarxm]

LGTM amazing @alafanechere

[marcosmarxm]

@alafanechere are you chancing to checksum?

[alafanechere]

Here the original field name for this S3 destination connector was include_checksum. I mistakenly renamed it to include_hash while doing a brutal search and replace it when renaming other code occurrences of checksum to hash.