Refactor implementation to cover template command

Signed-off-by: Szymon Gibała <szymongib@gmail.com>

cmd/helm/status.go

@@ -104,10 +104,22 @@ type statusPrinter struct {
 }
 
 func (s statusPrinter) WriteJSON(out io.Writer) error {
+	if s.hideSecrets {
+		err := sanitize.HideManifestSecrets(s.release)
+		if err != nil {
+			return err
+		}
+	}
 	return output.EncodeJSON(out, s.release)
 }
 
 func (s statusPrinter) WriteYAML(out io.Writer) error {
+	if s.hideSecrets {
+		err := sanitize.HideManifestSecrets(s.release)
+		if err != nil {
+			return err
+		}
+	}
 	return output.EncodeYAML(out, s.release)
 }
 
@@ -115,6 +127,13 @@ func (s statusPrinter) WriteTable(out io.Writer) error {
 	if s.release == nil {
 		return nil
 	}
+	if s.hideSecrets {
+		err := sanitize.HideManifestSecrets(s.release)
+		if err != nil {
+			return err
+		}
+	}
+
 	fmt.Fprintf(out, "NAME: %s\n", s.release.Name)
 	if !s.release.Info.LastDeployed.IsZero() {
 		fmt.Fprintf(out, "LAST DEPLOYED: %s\n", s.release.Info.LastDeployed.Format(time.ANSIC))
@@ -172,16 +191,7 @@ func (s statusPrinter) WriteTable(out io.Writer) error {
 		for _, h := range s.release.Hooks {
 			fmt.Fprintf(out, "---\n# Source: %s\n%s\n", h.Path, h.Manifest)
 		}
-		var err error
-		manifest := s.release.Manifest
-		if s.hideSecrets {
-			manifest, err = sanitize.HideSecrets(manifest)
-			if err != nil {
-				return err
-			}
-		}
-
-		fmt.Fprintf(out, "MANIFEST:\n%s\n", manifest)
+		fmt.Fprintf(out, "MANIFEST:\n%s\n", s.release.Manifest)
 	}
 
 	if len(s.release.Info.Notes) > 0 {

cmd/helm/template.go

@@ -27,6 +27,8 @@ import (
 	"sort"
 	"strings"
 
+	"helm.sh/helm/v3/pkg/cli/sanitize"
+
 	"helm.sh/helm/v3/pkg/release"
 
 	"github.com/spf13/cobra"
@@ -79,6 +81,13 @@ func newTemplateCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 				return err
 			}
 
+			if settings.HideSecrets {
+				err := sanitize.HideManifestSecrets(rel)
+				if err != nil {
+					return fmt.Errorf("failed to hide manifest secrets: %w", err)
+				}
+			}
+
 			// We ignore a potential error here because, when the --debug flag was specified,
 			// we always want to print the YAML, even if it is not valid. The error is still returned afterwards.
 			if rel != nil {

pkg/cli/sanitize/hide_secrets.go

@@ -20,6 +20,8 @@ import (
 	"fmt"
 	"strings"
 
+	"helm.sh/helm/v3/pkg/release"
+
 	"gopkg.in/yaml.v2"
 )
 
@@ -27,9 +29,25 @@ const (
 	hiddenSecretValue = "[HIDDEN]"
 )
 
-// HideSecrets replaces values in Secrets in the chart manifest with
+// HideManifestSecrets sanitizes release manifest and replaces it.
+// Manifest cannot be applied after this operation.
+func HideManifestSecrets(r *release.Release) error {
+	if r == nil {
+		return nil
+	}
+	manifest, err := hideSecrets(r.Manifest)
+	if err != nil {
+		return err
+	}
+
+	r.Manifest = manifest
+
+	return nil
+}
+
+// hideSecrets replaces values in Secrets in the chart manifest with
 // `[HIDDEN]` value.
-func HideSecrets(manifest string) (string, error) {
+func hideSecrets(manifest string) (string, error) {
 	resources := strings.Split(manifest, "\n---")
 	outRes := make([]string, 0, len(resources))
 

pkg/cli/sanitize/hide_secrets_test.go

@@ -22,29 +22,49 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"helm.sh/helm/v3/pkg/release"
 )
 
-func TestHideSecrets(t *testing.T) {
+func TestHideManifestSecrets(t *testing.T) {
 
-	t.Run("hide secret values", func(t *testing.T) {
+	t.Run("replace manifest with sanitized one", func(t *testing.T) {
 		manifestRaw, err := ioutil.ReadFile("testdata/manifest-input.yaml")
 		require.NoError(t, err)
 		expectedManifestRaw, err := ioutil.ReadFile("testdata/manifest-sanitized.yaml")
 		require.NoError(t, err)
 
-		sanitizedManifest, err := HideSecrets(string(manifestRaw))
+		rel := &release.Release{
+			Name:     "test",
+			Manifest: string(manifestRaw),
+		}
+
+		err = HideManifestSecrets(rel)
 		require.NoError(t, err)
 
-		assert.Equal(t, string(expectedManifestRaw), sanitizedManifest)
+		assert.Equal(t, string(expectedManifestRaw), rel.Manifest)
 	})
 
-	t.Run("do not modify, when no secret values", func(t *testing.T) {
+	t.Run("do not modify manifest when no secret values", func(t *testing.T) {
 		manifestRaw, err := ioutil.ReadFile("testdata/manifest-no-secret.yaml")
 		require.NoError(t, err)
 
-		sanitizedManifest, err := HideSecrets(string(manifestRaw))
+		rel := &release.Release{
+			Name:     "test",
+			Manifest: string(manifestRaw),
+		}
+
+		err = HideManifestSecrets(rel)
 		require.NoError(t, err)
 
-		assert.Equal(t, string(manifestRaw), sanitizedManifest)
+		assert.Equal(t, string(manifestRaw), rel.Manifest)
+	})
+
+	t.Run("ignore nil release", func(t *testing.T) {
+		var rel *release.Release
+
+		err := HideManifestSecrets(rel)
+		require.NoError(t, err)
+		assert.Nil(t, rel)
 	})
 }