Exclude misgenerated Vault path templates when pipeline name is missing
@@ -2,6 +2,7 @@ package vault
import (
"path"
+ "strings"
"text/template"
"time"
@@ -29,8 +30,15 @@ type Vault struct {
func (v Vault) NewSecretLookupPaths(teamName string, pipelineName string, allowRootPath bool) []creds.SecretLookupPath {
lookupPaths := []creds.SecretLookupPath{}
for _, tmpl := range v.LookupTemplates {
+ lpath := creds.NewSecretLookupWithTemplate(tmpl, teamName, pipelineName)
+
+ // Avoid adding an unintended path from expanding "/{{.Pipeline}}/"
+ // when there is no pipeline name present
+ samplePath, err := lpath.VariableToSecretPath("variable")
+ if err == nil && !strings.Contains(samplePath, "//") {
lookupPaths = append(lookupPaths, creds.NewSecretLookupWithTemplate(tmpl, teamName, pipelineName))
}
+ }
if v.SharedPath != "" {
lookupPaths = append(lookupPaths, creds.NewSecretLookupWithPrefix(path.Join(v.Prefix, v.SharedPath)+"/"))
}
