feat: add Sensitive field to OutputItem for secure workflow data storage

PA
3mo ago
+17-0

Description

Add Sensitive field to OutputItem struct to support secure storage of workflow output data.

Fixes: https://github.com/kubevela/kubevela/issues/7153

Problem

KubeVela's workflow engine stores inter-step runtime state in ConfigMaps. When workflow steps pass sensitive data (tokens, credentials, API keys) via outputs, that data is persisted in plaintext in the ConfigMap, creating a security vulnerability.

Solution

Add an optional Sensitive bool field to OutputItem. When sensitive: true is set on a workflow output, the workflow engine (in kubevela/workflow) will store that output in a Kubernetes Secret instead of a ConfigMap.

Changes

  • Added Sensitive bool field to OutputItem struct in apis/oam/v1alpha1/workflow_types.go
  • Field is optional (omitempty) for backward compatibility

Usage

workflow:
  steps:
    - name: read-secret
      type: read-object
      outputs:
        - name: secretData
          valueFrom: output.value.data
          sensitive: true  # Store in Secret instead of ConfigMap

Related PRs

  • kubevela/workflow PR (pending): Implements the dual-store mechanism that uses this field

Summary by cubic

Add a Sensitive field to OutputItem to mark sensitive workflow outputs so they are stored in Kubernetes Secrets instead of ConfigMaps. Updates the Workflow CRD to expose the field and prevent plaintext exposure of tokens and credentials.

  • New Features
    • Added optional Sensitive bool to OutputItem (json:"sensitive,omitempty") in apis/oam/v1alpha1/workflow_types.go, and updated crds/core.oam.dev_workflows.yaml to include the sensitive schema.
    • When true, kubevela/workflow stores the output in a Secret.