fix(coderd): mark provisioner daemon psk as secret (#12322)

johnstcn · web-flow · commit b9e2d0a40089 · 2024-02-27T16:33:32.000Z
* fix(coderd): mark provisioner daemon psk as secret

Marks provisioner daemon PSK with the secret annotation.
This ensures it will be scrubbed from API requests to
/api/v2/deployment/config.

* make gen
diff --git a/cli/testdata/server-config.yaml.golden b/cli/testdata/server-config.yaml.golden
@@ -383,9 +383,6 @@ provisioning:
   # Time to force cancel provisioning tasks that are stuck.
   # (default: 10m0s, type: duration)
   forceCancelInterval: 10m0s
-  # Pre-shared key to authenticate external provisioner daemons to Coder server.
-  # (default: <unset>, type: string)
-  daemonPSK: ""
 # Enable one or more experiments. These are not ready for production. Separate
 # multiple experiments with commas, or enter '*' to opt-in to all available
 # experiments.
diff --git a/coderd/deployment_test.go b/coderd/deployment_test.go
@@ -27,6 +27,7 @@ func TestDeploymentValues(t *testing.T) {
 	cfg.PostgresURL.Set(hi)
 	cfg.SCIMAPIKey.Set(hi)
 	cfg.ExternalTokenEncryptionKeys.Set("the_random_key_we_never_expected,an_other_key_we_never_unexpected")
+	cfg.Provisioner.DaemonPSK = "provisionersftw"
 
 	client := coderdtest.New(t, &coderdtest.Options{
 		DeploymentValues: cfg,
@@ -46,6 +47,7 @@ func TestDeploymentValues(t *testing.T) {
 	require.Empty(t, scrubbed.Values.PostgresURL.Value())
 	require.Empty(t, scrubbed.Values.SCIMAPIKey.Value())
 	require.Empty(t, scrubbed.Values.ExternalTokenEncryptionKeys.Value())
+	require.Empty(t, scrubbed.Values.Provisioner.DaemonPSK.Value())
 }
 
 func TestDeploymentStats(t *testing.T) {
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
@@ -1408,7 +1408,7 @@ when required by your organization's security policy.`,
 			Env:         "CODER_PROVISIONER_DAEMON_PSK",
 			Value:       &c.Provisioner.DaemonPSK,
 			Group:       &deploymentGroupProvisioning,
-			YAML:        "daemonPSK",
+			Annotations: clibase.Annotations{}.Mark(annotationSecretKey, "true"),
 		},
 		// RateLimit settings
 		{
diff --git a/codersdk/deployment_test.go b/codersdk/deployment_test.go
@@ -71,6 +71,9 @@ func TestDeploymentValues_HighlyConfigurable(t *testing.T) {
 			flag: true,
 			env:  true,
 		},
+		"Provisioner Daemon Pre-shared Key (PSK)": {
+			yaml: true,
+		},
 	}
 
 	set := (&codersdk.DeploymentValues{}).Options()
diff --git a/docs/cli/server.md b/docs/cli/server.md

Original file line number	Diff line number	Diff line change
@@ -1408,7 +1408,7 @@ when required by your organization's security policy.`,
`1408`	`1408`	`Env: "CODER_PROVISIONER_DAEMON_PSK",`
`1409`	`1409`	`Value: &c.Provisioner.DaemonPSK,`
`1410`	`1410`	`Group: &deploymentGroupProvisioning,`
`1411`		`- YAML: "daemonPSK",`
	`1411`	`+ Annotations: clibase.Annotations{}.Mark(annotationSecretKey, "true"),`
`1412`	`1412`	`},`
`1413`	`1413`	`// RateLimit settings`
`1414`	`1414`	`{`
Original file line number	Diff line number	Diff line change
`@@ -71,6 +71,9 @@ func TestDeploymentValues_HighlyConfigurable(t *testing.T) {`
`71`	`71`	`flag: true,`
`72`	`72`	`env: true,`
`73`	`73`	`},`
	`74`	`+ "Provisioner Daemon Pre-shared Key (PSK)": {`
	`75`	`+ yaml: true,`
	`76`	`+ },`
`74`	`77`	`}`
`75`	`78`
`76`	`79`	`set := (&codersdk.DeploymentValues{}).Options()`