General random bytes, perhaps base64 encoded? about terraform-provider-random HOT 9 CLOSED

FYI, random_id seems to do all of this.

I was using it to generate a 32-byte random etcd encryption key for Kubernetes like so:

# https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#encrypting-your-data
resource "random_id" "etcd_encryption_key" {
  byte_length = 32
}

output "etcd_encryption_key" {
  value = "${random_id.etcd_encryption_key.b64_std}"
}

Unfortunately the value ends up getting printed to the console during state refresh, which isn't great if you're treating it as secret. I opened #66 for that.

from terraform-provider-random.

The only issue with random_id is that the output cannot be marked as sensitive even though it's generally being used to generate cryptography keys.

from terraform-provider-random.

Just found #66 where the idea of making random_id sensitive was rejected because it's outside the scope of "intended use."

This seems short-sighted to me. There are plenty of legitimate use cases for generating a TF-managed bunch of random bytes securely, and people are either going to use this despite the risks, or spend a bunch of time hacking together inferior solutions.

It looks like #272 would address the issue. 🤞

from terraform-provider-random.

To anyone looking for this, I published the provider in the PR in a separate provider.

https://registry.terraform.io/providers/Socolin/randombyte/latest

resource "randombyte_bytes" "name" {
    length = 64
}

from terraform-provider-random.

I realize that using random_integer that way is not really useful. An alternative might be to use random_integer 16 times, but that still gives a difficult to manage result, and appears to use math/rand rather than crypt/rand (unlike uuid and string):

provider "random"{}

resource "random_integer" test {
  count = 16
  min = 1
  max = 256
}

output "int" {
  value = "${random_integer.test.*.result}"
}

The output is not easy to work with in HCL, either. Plenty easy in go though. :-)

from terraform-provider-random.

I managed to do this. I don't love it, would be nice if it were a basic resource.

provider "random"{}

resource "random_string" test {
  length = 16
  override_special = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
}

output "string" {
  value = "'${base64encode(random_string.test.result)}'"
}

from terraform-provider-random.

Funny, I didn't find that before. Is it new for 0.12?

from terraform-provider-random.

This would be great addition. Now we have to generate truly random bytes, converting those to base64 and manually storing them as secrets. This is cumbersome and people might cut corners and either generate insufficiently random passwords or exposing the secret when doing the manual copying.

If having a random_id being secret is indeed outside the scope of intended use, could we please have #272 merged to have new random_bytes resource?

from terraform-provider-random.

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

from terraform-provider-random.