@@ -18,6 +18,7 @@ package crd
1818
1919import (
2020 "encoding/base64"
21+ "fmt"
2122 "strings"
2223
2324 "k8s.io/kube-openapi/pkg/validation/spec"
@@ -35,15 +36,15 @@ func isSecretRef(s spec.Schema) (string, bool) {
3536 return "" , false
3637}
3738
38- func ExtractSecrets (componentName string , schema Schema , spec map [string ]interface {}) map [string ]string {
39+ func ExtractSecrets (componentName string , schema Schema , spec map [string ]interface {}) ( map [string ]string , error ) {
3940 result := make (map [string ]string )
4041 for k , v := range spec {
4142 if nestedSchema , ok := schema .schema .Properties [k ]; ok {
4243 if key , ok := isSecretRef (nestedSchema ); ok {
4344 if secretValue , ok := v .(string ); ok {
4445 result [k ] = base64 .StdEncoding .EncodeToString ([]byte (secretValue ))
4546 } else {
46- // error, we want a secret value here
47+ return nil , fmt . Errorf ( "%q is expected to contain secret string, got %T" , k , v )
4748 }
4849 spec [k ] = map [string ]interface {}{
4950 key : map [string ]interface {}{
@@ -53,13 +54,15 @@ func ExtractSecrets(componentName string, schema Schema, spec map[string]interfa
5354 }
5455 }
5556 if nestedSpec , ok := v .(map [string ]interface {}); ok {
56- for nestedKey , nestedValue := range ExtractSecrets (componentName , Schema {nestedSchema }, nestedSpec ) {
57+ nestedSecrets , err := ExtractSecrets (componentName , Schema {nestedSchema }, nestedSpec )
58+ if err != nil {
59+ return nil , err
60+ }
61+ for nestedKey , nestedValue := range nestedSecrets {
5762 result [nestedKey ] = nestedValue
5863 }
5964 }
60- } else {
61- // spec mismatch
6265 }
6366 }
64- return result
67+ return result , nil
6568}
0 commit comments