Option to hide sensitive data in specific fields

[kvaps]

Summary

We need an opportunity mask or hide specific fields for all resources.

Motivation

We're using qbec to generate and render kubernetes manifests from jsonnet files.
Just like ksonnet it also can add its own last-applied annotation with gziped secret encoded in base64.

while secret data is hidden, the last-applied annotation doesn't:

Proposal

Add configuration option into argocd configmap:

data:
  resource.customizations: |
    "*":
      maskFields:
      - field: "metadata.annotations.\"qbec.io/last-applied\""

[Gallardo994]

Not sure it can cover everything you would like to "hide", but have you tried SealedSecrets? https://github.com/bitnami-labs/sealed-secrets

[kvaps]

This annotation is generated automatically each time when new manifest is applied.

I mean that argocd is hiding the secrets automatically even in kubectl.kubernetes.io/last-applied-configuration annotation:

Which is totaly fine, but it would be more nicier to have this behavior configurable (which fields to hide from user)