feat: add explicit raw secret values

Author: shirkevich

cmd/secret/enumerate.go

@@ -18,9 +18,10 @@ import (
 // scopeEntry is a single (stack, component) instance that declares one or more secrets, paired
 // with its resolved component section (declarations carry their derived scope after stack merge).
 type scopeEntry struct {
-	Stack     string
-	Component string
-	Section   map[string]any
+	Stack         string
+	Component     string
+	ComponentType string
+	Section       map[string]any
 }
 
 // enumerateScopesFn is a seam so tests can inject scope entries without real stack processing.
@@ -94,7 +95,7 @@ func secretEntriesInStack(stackName string, stackMap map[string]any, componentFi
 		return nil
 	}
 	var entries []scopeEntry
-	for _, typeRaw := range comps {
+	for componentType, typeRaw := range comps {
 		typeMap, ok := typeRaw.(map[string]any)
 		if !ok {
 			continue
@@ -110,7 +111,7 @@ func secretEntriesInStack(stackName string, stackMap map[string]any, componentFi
 			if len(secrets.ExtractDeclarations(section)) == 0 {
 				continue
 			}
-			entries = append(entries, scopeEntry{Stack: stackName, Component: compName, Section: section})
+			entries = append(entries, scopeEntry{Stack: stackName, Component: compName, ComponentType: componentType, Section: section})
 		}
 	}
 	return entries

cmd/secret/set.go

@@ -41,7 +41,7 @@ func init() {
 func runSecretSet(cmd *cobra.Command, args []string) error {
 	defer perf.Track(nil, "secret.runSecretSet")()
 
-	scope, err := parseScope(cmd, args)
+	scope, err := parseSetScope(cmd, args)
 	if err != nil {
 		return err
 	}
@@ -70,6 +70,75 @@ func runSecretSet(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
+// parseSetScope permits --component to be omitted only when a positional name resolves to one
+// consistent global declaration in the selected stack. A component is still used internally to
+// load the inherited declaration, but it cannot affect the resulting global backend coordinate.
+func parseSetScope(cmd *cobra.Command, args []string) (secretScope, error) {
+	scope, err := parseScopeStack(cmd, args)
+	if err != nil {
+		return scope, err
+	}
+	if scope.Component != "" || len(args) == 0 {
+		return requireScopeComponent(scope, cmd, args)
+	}
+	target, err := setTargetFromArg(args[0])
+	if err != nil {
+		return scope, err
+	}
+	component, componentType, err := findGlobalSetContext(scope, target.name)
+	if err != nil {
+		return scope, err
+	}
+	scope.Component = component
+	if scope.ComponentType == "" {
+		scope.ComponentType = componentType
+	}
+	return scope, nil
+}
+
+func findGlobalSetContext(scope secretScope, name string) (string, string, error) {
+	entries, _, err := enumerateScopesFn(secretScope{Stack: scope.Stack, ComponentType: scope.ComponentType})
+	if err != nil {
+		return "", "", componentRequiredForSet(name, fmt.Sprintf("the global declaration could not be verified: %v", err))
+	}
+	var selected *secrets.Declaration
+	var component, componentType string
+	for _, entry := range entries {
+		if entry.Stack != "" && entry.Stack != scope.Stack {
+			continue
+		}
+		if scope.ComponentType != "" && entry.ComponentType != "" && entry.ComponentType != scope.ComponentType {
+			continue
+		}
+		decl, ok := secrets.ExtractDeclarations(entry.Section)[name]
+		if !ok {
+			continue
+		}
+		if decl.Scope != secrets.ScopeGlobal {
+			return "", "", componentRequiredForSet(name, "the declaration is not global")
+		}
+		if selected != nil && decl != *selected {
+			return "", "", componentRequiredForSet(name, "global declarations differ between components")
+		}
+		copy := decl
+		selected = &copy
+		if component == "" {
+			component, componentType = entry.Component, entry.ComponentType
+		}
+	}
+	if selected == nil {
+		return "", "", componentRequiredForSet(name, "no global declaration was found in the stack")
+	}
+	return component, componentType, nil
+}
+
+func componentRequiredForSet(name, reason string) error {
+	return errUtils.Build(errUtils.ErrRequiredFlagNotProvided).
+		WithExplanationf("--component is required to set secret %q: %s", name, reason).
+		WithHint("Omit --component only for a secret declared with `scope: global`; otherwise specify --component or -c").
+		Err()
+}
+
 // setSuccessMessage describes where the value was written: shared scopes (stack, global) name the
 // shared location so the user knows every consumer sees the new value.
 func setSuccessMessage(svc secretService, scope secretScope, name string) string {
@@ -96,13 +165,7 @@ type setTarget struct {
 // TTY, and falls back to the standard "NAME required" error in non-interactive contexts.
 func resolveSetName(svc secretService, args []string) (setTarget, error) {
 	if len(args) > 0 {
-		name, value, hasValue := strings.Cut(args[0], "=")
-		name = strings.TrimSpace(name)
-		if name == "" {
-			return setTarget{}, errUtils.Build(errUtils.ErrRequiredFlagNotProvided).
-				WithExplanation("secret NAME is required").Err()
-		}
-		return setTarget{name: name, value: value, hasValue: hasValue}, nil
+		return setTargetFromArg(args[0])
 	}
 
 	names := declaredNames(svc)
@@ -118,6 +181,16 @@ func resolveSetName(svc secretService, args []string) (setTarget, error) {
 	return setTarget{name: chosen}, nil
 }
 
+func setTargetFromArg(arg string) (setTarget, error) {
+	name, value, hasValue := strings.Cut(arg, "=")
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return setTarget{}, errUtils.Build(errUtils.ErrRequiredFlagNotProvided).
+			WithExplanation("secret NAME is required").Err()
+	}
+	return setTarget{name: name, value: value, hasValue: hasValue}, nil
+}
+
 // declaredNames returns the sorted declared secret names for the service's scope.
 func declaredNames(svc secretService) []string {
 	decls := svc.Declarations()

cmd/secret/set_test.go

@@ -80,6 +80,57 @@ func TestRunSecretSet_SharedScopes(t *testing.T) {
 	assert.Equal(t, "GLOBAL", svc2.setCalls[0].name)
 }
 
+func TestRunSecretSet_GlobalScopeWithoutComponent(t *testing.T) {
+	svc := newFakeSecretService()
+	svc.scopes = map[string]secrets.Scope{"SHARED_TOKEN": secrets.ScopeGlobal}
+	installService(t, svc, nil)
+	overrideEnumerateScopes(t, []scopeEntry{
+		{
+			Stack:         "dev",
+			Component:     "example-service",
+			ComponentType: "helm",
+			Section: secretDeclarationSection("SHARED_TOKEN", map[string]any{
+				"store": "example-secrets",
+				"scope": "global",
+			}),
+		},
+	}, nil)
+
+	err := runSecretSubcommand(t, "set", "SHARED_TOKEN=v1", "--stack", "dev")
+	require.NoError(t, err)
+	require.Len(t, svc.setCalls, 1)
+	assert.Equal(t, "SHARED_TOKEN", svc.setCalls[0].name)
+	assert.Equal(t, "v1", svc.setCalls[0].value)
+}
+
+func TestRunSecretSet_NonGlobalScopeStillRequiresComponent(t *testing.T) {
+	svc := newFakeSecretService()
+	installService(t, svc, nil)
+	overrideEnumerateScopes(t, []scopeEntry{
+		{
+			Stack:         "dev",
+			Component:     "example-service",
+			ComponentType: "helm",
+			Section: secretDeclarationSection("API_KEY", map[string]any{
+				"store": "example-secrets",
+				"scope": "instance",
+			}),
+		},
+	}, nil)
+
+	err := runSecretSubcommand(t, "set", "API_KEY=v1", "--stack", "dev")
+	require.ErrorIs(t, err, errUtils.ErrRequiredFlagNotProvided)
+	assert.Empty(t, svc.setCalls)
+}
+
+func secretDeclarationSection(name string, spec map[string]any) map[string]any {
+	return map[string]any{
+		"secrets": map[string]any{
+			"vars": map[string]any{name: spec},
+		},
+	}
+}
+
 func TestRunSecretSet_Prompt(t *testing.T) {
 	svc := newFakeSecretService()
 	installService(t, svc, nil)

cmd/secret/shared.go

@@ -74,6 +74,17 @@ func parseFacets(cmd *cobra.Command) (secretScope, error) {
 // non-interactive shells). In a non-interactive context a missing flag falls back to the standard
 // "required flag not provided" error, preserving today's pipeline behavior.
 func parseScope(cmd *cobra.Command, args []string) (secretScope, error) {
+	scope, err := parseScopeStack(cmd, args)
+	if err != nil {
+		return scope, err
+	}
+	return requireScopeComponent(scope, cmd, args)
+}
+
+// parseScopeStack resolves the common facets and requires only a stack. Commands that can prove
+// a component is irrelevant (for example, setting a uniquely global secret) use this narrower
+// helper and discover a declaration-bearing component context afterward.
+func parseScopeStack(cmd *cobra.Command, args []string) (secretScope, error) {
 	v := viper.GetViper()
 	if err := secretParser.BindFlagsToViper(cmd, v); err != nil {
 		return secretScope{}, err
@@ -100,7 +111,10 @@ func parseScope(cmd *cobra.Command, args []string) (secretScope, error) {
 	}
 	// Make the chosen stack visible to the component completion (it filters by --stack).
 	v.Set(cfg.StackStr, scope.Stack)
+	return scope, nil
+}
 
+func requireScopeComponent(scope secretScope, cmd *cobra.Command, args []string) (secretScope, error) {
 	if scope.Component == "" {
 		chosen, err := flags.PromptForMissingRequired("component", "Choose a component", componentCompletion, cmd, args)
 		if err != nil {

pkg/component/helm/secret_values_integration_test.go

@@ -0,0 +1,145 @@
+package helm
+
+import (
+	"context"
+	"encoding/json"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
+	e "github.com/cloudposse/atmos/internal/exec"
+	"github.com/cloudposse/atmos/pkg/auth"
+	cfg "github.com/cloudposse/atmos/pkg/config"
+	iolib "github.com/cloudposse/atmos/pkg/io"
+	"github.com/cloudposse/atmos/pkg/keyring"
+	"github.com/cloudposse/atmos/pkg/manifest"
+	"github.com/cloudposse/atmos/pkg/schema"
+	"github.com/cloudposse/atmos/pkg/store"
+	storeproviders "github.com/cloudposse/atmos/pkg/store/providers"
+)
+
+const (
+	serviceAccountJSON = `{"type":"service_account","private_key":"-----BEGIN PRIVATE KEY-----\nAAAA\nBBBB\n-----END PRIVATE KEY-----\n","client_email":"service@example.iam.gserviceaccount.com"}`
+	plainSecret        = "single-line-example-token"
+	privateKey         = "-----BEGIN PRIVATE KEY-----\nAAAA\nBBBB\n-----END PRIVATE KEY-----\n"
+)
+
+// jsonDecodingStore reproduces the structured Get behavior of cloud secret stores while using
+// the in-memory keychain backend. GetRaw preserves the opaque payload for !secret ... | raw.
+type jsonDecodingStore struct {
+	store.Store
+}
+
+func (s *jsonDecodingStore) Get(stack, component, key string) (any, error) {
+	raw, err := s.GetRaw(stack, component, key)
+	if err != nil {
+		return nil, err
+	}
+	var decoded any
+	if err := json.Unmarshal([]byte(raw), &decoded); err == nil {
+		return decoded, nil
+	}
+	return raw, nil
+}
+
+func (s *jsonDecodingStore) GetRaw(stack, component, key string) (string, error) {
+	return s.Store.(store.RawStore).GetRaw(stack, component, key)
+}
+
+func TestNativeHelmSecretRawAndStructuredValuesMaskIndentedMultilineValues(t *testing.T) {
+	fixture, err := filepath.Abs(filepath.Join("..", "..", "..", "tests", "fixtures", "scenarios", "helm-secret-values"))
+	require.NoError(t, err)
+	t.Chdir(fixture)
+	t.Setenv("ATMOS_CLI_CONFIG_PATH", ".")
+	t.Setenv("ATMOS_BASE_PATH", ".")
+
+	info := schema.ConfigAndStacksInfo{
+		ComponentFromArg: "secret-values",
+		ComponentType:    cfg.HelmComponentType,
+		Stack:            "dev",
+		SubCommand:       "template",
+		SecretsMaskOnly:  true,
+	}
+	atmosConfig, err := cfg.InitCliConfig(info, true)
+	require.NoError(t, err)
+	require.Equal(t, store.KindGCPSecret, atmosConfig.StoresConfig["gcp-secrets"].Kind)
+
+	memoryStore, err := storeproviders.NewKeychainStore(&storeproviders.KeychainStoreOptions{Backend: keyring.TypeMemory})
+	require.NoError(t, err)
+	offlineStore := &jsonDecodingStore{Store: memoryStore}
+	atmosConfig.Stores["gcp-secrets"] = offlineStore
+
+	// Top-level declarations are stack scoped, so the component segment is intentionally empty.
+	require.NoError(t, offlineStore.Set("dev", "", "service-account-json", serviceAccountJSON))
+	require.NoError(t, offlineStore.Set("dev", "", "plain-token", plainSecret))
+	require.NoError(t, offlineStore.Set("dev", "", "signing-key", privateKey))
+
+	info.SecretsMaskOnly = false
+	info, err = e.ProcessStacks(&atmosConfig, info, true, true, true, nil, auth.AuthManager(nil))
+	require.NoError(t, err)
+
+	values, ok := info.ComponentSection[cfg.ValuesSectionName].(map[string]any)
+	require.True(t, ok)
+	structured, ok := values["structured_service_account"].(map[string]any)
+	require.True(t, ok, "bare !secret must preserve the existing structured store contract")
+	assert.Equal(t, "service_account", structured["type"])
+	env, ok := values["env"].([]any)
+	require.True(t, ok)
+	require.Len(t, env, 4)
+	assert.Equal(t, serviceAccountJSON, envValue(t, env, "SERVICE_ACCOUNT_JSON"))
+	assert.Equal(t, "service@example.iam.gserviceaccount.com", envValue(t, env, "CLIENT_EMAIL"))
+	assert.Equal(t, plainSecret, envValue(t, env, "PLAIN_TOKEN"))
+	assert.Equal(t, privateKey, envValue(t, env, "SIGNING_KEY"))
+
+	componentPath := filepath.Join(fixture, "components", "helm", "secret-values")
+	spec, err := buildChartSpec(&atmosConfig, &info, componentPath)
+	require.NoError(t, err)
+	rendered, err := renderManifest(context.Background(), spec)
+	require.NoError(t, err)
+
+	objects, err := manifest.DecodeObjects([]byte(rendered))
+	require.NoError(t, err)
+	require.Len(t, objects, 1)
+	renderedEnv, found, err := unstructured.NestedSlice(objects[0].Object, "spec", "template", "spec", "containers", "0", "env")
+	if err != nil || !found {
+		// NestedSlice cannot index arrays by string; extract the container first.
+		containers, containersFound, containersErr := unstructured.NestedSlice(objects[0].Object, "spec", "template", "spec", "containers")
+		require.NoError(t, containersErr)
+		require.True(t, containersFound)
+		container := containers[0].(map[string]any)
+		renderedEnv = container["env"].([]any)
+	}
+	assert.Equal(t, serviceAccountJSON, envValue(t, renderedEnv, "SERVICE_ACCOUNT_JSON"), "Helm env.value must remain a scalar string")
+
+	masker := iolib.GetContext().Masker()
+	t.Cleanup(func() {
+		masker.Clear()
+		masker.SetEnabled(true)
+	})
+	masked := masker.Mask(rendered)
+	assert.NotContains(t, masked, "BEGIN PRIVATE KEY")
+	assert.NotContains(t, masked, "AAAA")
+	assert.NotContains(t, masked, "BBBB")
+	assert.NotContains(t, masked, plainSecret)
+	assert.Contains(t, masked, masker.Replacement())
+
+	masker.SetEnabled(false)
+	unmasked := masker.Mask(rendered)
+	assert.Contains(t, unmasked, "BEGIN PRIVATE KEY")
+	assert.Contains(t, unmasked, plainSecret)
+}
+
+func envValue(t *testing.T, env []any, name string) any {
+	t.Helper()
+	for _, item := range env {
+		entry, ok := item.(map[string]any)
+		if ok && entry["name"] == name {
+			return entry["value"]
+		}
+	}
+	t.Fatalf("environment entry %q not found", name)
+	return nil
+}