Fix sensitive values being replaced with '(sensitive value)' in Helm deployments

.changelog/1644.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+`helm_release`: Fix shallow clone bug causing nested sensitive values to be redacted in the k8s API
+```

helm/data_helm_template_test.go

@@ -22,11 +22,12 @@ func TestAccDataTemplate_basic(t *testing.T) {
 		Steps: []resource.TestStep{{
 			Config: testAccDataHelmTemplateConfigBasic(testResourceName, namespace, name, "1.2.3"),
 			Check: resource.ComposeAggregateTestCheckFunc(
-				resource.TestCheckResourceAttr(datasourceAddress, "manifests.%", "5"),
+				resource.TestCheckResourceAttr(datasourceAddress, "manifests.%", "6"),
 				resource.TestCheckResourceAttrSet(datasourceAddress, "manifests.templates/deployment.yaml"),
 				resource.TestCheckResourceAttrSet(datasourceAddress, "manifests.templates/service.yaml"),
 				resource.TestCheckResourceAttrSet(datasourceAddress, "manifests.templates/serviceaccount.yaml"),
 				resource.TestCheckResourceAttrSet(datasourceAddress, "manifests.templates/configmaps.yaml"),
+				resource.TestCheckResourceAttrSet(datasourceAddress, "manifests.templates/secrets.yaml"),
 				resource.TestCheckResourceAttrSet(datasourceAddress, "manifests.templates/tests/test-connection.yaml"),
 				resource.TestCheckResourceAttrSet(datasourceAddress, "manifest"),
 				resource.TestCheckResourceAttrSet(datasourceAddress, "notes"),

helm/resource_helm_release.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"maps"
 	"net/url"
 	"os"
 	pathpkg "path"
@@ -1424,10 +1423,28 @@ func getValue(base map[string]interface{}, set setResourceModel) diag.Diagnostic
 	return diags
 }
 
+// deepCloneMap creates a deep copy of a map[string]interface{}
+func deepCloneMap(m map[string]interface{}) map[string]interface{} {
+	if m == nil {
+		return nil
+	}
+
+	clone := make(map[string]interface{}, len(m))
+	for k, v := range m {
+		switch val := v.(type) {
+		case map[string]interface{}:
+			clone[k] = deepCloneMap(val)
+		default:
+			clone[k] = v
+		}
+	}
+	return clone
+}
+
 func logValues(ctx context.Context, values map[string]interface{}, state *HelmReleaseModel) diag.Diagnostics {
 	var diags diag.Diagnostics
-	// Cloning values map
-	c := maps.Clone(values)
+	// Deep cloning values map to avoid modifying the original
+	c := deepCloneMap(values)
 
 	cloakSetValues(c, state)
 
@@ -1519,10 +1536,12 @@ func setReleaseAttributes(ctx context.Context, state *HelmReleaseModel, identity
 	}
 
 	// Cloak sensitive values in the release config
-	cloakSetValues(r.Config, state)
 	values := "{}"
 	if r.Config != nil {
-		v, err := json.Marshal(r.Config)
+		// Deep clone the config to avoid modifying the original
+		configClone := deepCloneMap(r.Config)
+		cloakSetValues(configClone, state)
+		v, err := json.Marshal(configClone)
 		if err != nil {
 			diags.AddError(
 				"Error marshaling values",

helm/resource_helm_release_test.go

@@ -33,6 +33,7 @@ import (
 	"helm.sh/helm/v3/pkg/releaseutil"
 	"helm.sh/helm/v3/pkg/repo"
 
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 )
@@ -386,20 +387,41 @@ func TestAccResourceRelease_cloakValues(t *testing.T) {
 	namespace := createRandomNamespace(t)
 	defer deleteNamespace(t, namespace)
 
+	secretKey := "cloakedData.cloaked"
+	secretValue := "foobar"
+
 	resource.Test(t, resource.TestCase{
-		// PreCheck:                 func() { testAccPreCheck(t) },
 		ProtoV6ProviderFactories: protoV6ProviderFactories(),
-		// CheckDestroy:             testAccCheckHelmReleaseDestroy(namespace),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccHelmReleaseConfigSensitiveValue(
-					testResourceName, namespace, name, "test-chart", "1.2.3", "foo", "bar",
+					testResourceName, namespace, name, "test-chart", "1.2.3", secretKey, secretValue,
 				),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttr("helm_release.test", "metadata.revision", "1"),
 					resource.TestCheckResourceAttr("helm_release.test", "status", release.StatusDeployed.String()),
-					resource.TestCheckResourceAttr("helm_release.test", "metadata.values",
-						"{\"foo\":\"(sensitive value)\"}"),
+					resource.TestCheckResourceAttr("helm_release.test", "metadata.values", `{"cloakedData":{"cloaked":"(sensitive value)"}}`),
+					func(s *terraform.State) error {
+						c, err := createKubernetesClient()
+						if err != nil {
+							return err
+						}
+
+						res, err := c.CoreV1().Secrets(namespace).Get(context.Background(), fmt.Sprintf("%s-test-chart", name), v1.GetOptions{})
+						if err != nil {
+							return err
+						}
+
+						v, ok := res.Data["cloaked"]
+						if !ok {
+							return fmt.Errorf("expected %q but secret value was nil", secretValue)
+						}
+
+						if string(v) != secretValue {
+							return fmt.Errorf("expected secret value to be %q but got %q", secretValue, v)
+						}
+						return nil
+					},
 				),
 			},
 		},
@@ -1036,8 +1058,8 @@ func testAccHelmReleaseConfigValues(resource, ns, name, chart, version string, v
 func testAccHelmReleaseConfigSensitiveValue(resource, ns, name, chart, version, key, value string) string {
 	return fmt.Sprintf(`
 		resource "helm_release" "%s" {
- 			name       = %q
 			namespace  = %q
+ 			name       = %q
 			repository = %q
 			chart      = %q
 			version    = %q
@@ -1049,7 +1071,7 @@ func testAccHelmReleaseConfigSensitiveValue(resource, ns, name, chart, version,
 				}
 			]
 		}
-	`, resource, name, ns, testRepositoryURL, chart, version, key, value)
+	`, resource, ns, name, testRepositoryURL, chart, version, key, value)
 }
 
 func testAccHelmReleaseConfigSet(resource, ns, name, version, setValue string) string {
@@ -2461,6 +2483,7 @@ func testAccHelmReleaseRecomputeMetadataSet(resource, ns, name string) string {
 		}
 `, resource, name, ns, resource)
 }
+
 func testAccHelmReleaseConfigSetLiteral(resource, ns, name, version string) string {
 	return fmt.Sprintf(`
 		resource "helm_release" "%s" {

helm/testdata/charts/test-chart/templates/secrets.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "test-chart.fullname" . }}
+data:
+  cloaked: {{ .Values.cloakedData.cloaked | b64enc }}

helm/testdata/charts/test-chart/values.yaml

@@ -77,3 +77,6 @@ nodeSelector: {}
 tolerations: []
 
 affinity: {}
+
+cloakedData: 
+  cloaked: secret