Follow-up from the review discussion on #204, filed separately so that PR stays docs-only.
Problem
configs is not marked Sensitive: true in either the pulsar_source or pulsar_sink schema, so any credentials embedded in it are echoed in terraform plan output and stored readably in state — regardless of the README's guidance (added in #204) to prefer secrets for credentials.
Proposed change
Add Sensitive: true to the configs attribute in pulsar/resource_pulsar_source.go and pulsar/resource_pulsar_sink.go, and audit pulsar_function for the same gap while at it.
Notes
This masks the value as (sensitive value) in plan/diff output; the value still lives in state (as with any sensitive attribute), so the README's secrets guidance remains the stronger recommendation. It may also affect diff readability for users who keep non-secret settings in configs — worth a changelog note.
Refs: @freeznet's review on #204.
Follow-up from the review discussion on #204, filed separately so that PR stays docs-only.
Problem
configsis not markedSensitive: truein either thepulsar_sourceorpulsar_sinkschema, so any credentials embedded in it are echoed interraform planoutput and stored readably in state — regardless of the README's guidance (added in #204) to prefersecretsfor credentials.Proposed change
Add
Sensitive: trueto theconfigsattribute inpulsar/resource_pulsar_source.goandpulsar/resource_pulsar_sink.go, and auditpulsar_functionfor the same gap while at it.Notes
This masks the value as
(sensitive value)in plan/diff output; the value still lives in state (as with any sensitive attribute), so the README'ssecretsguidance remains the stronger recommendation. It may also affect diff readability for users who keep non-secret settings inconfigs— worth a changelog note.Refs: @freeznet's review on #204.