Prevent render failure from leaking secrets

lib/krane/render_task.rb

@@ -8,6 +8,8 @@
 module Krane
   # Render templates
   class RenderTask
+    include Krane::TemplateReporting
+
     # Initializes the render task
     #
     # @param logger [Object] Logger object (defaults to an instance of Krane::FormattedLogger)
@@ -67,7 +69,12 @@ def render_templates(stream, template_sets)
 
       count
     rescue Krane::InvalidTemplateError => exception
-      log_invalid_template(exception)
+      record_invalid_template(
+        logger: @logger,
+        err: exception.to_s,
+        filename: exception.filename,
+        content: exception.content
+      )
       raise
     end
 
@@ -105,16 +112,5 @@ def validate_configuration(template_sets)
         raise Krane::TaskConfigurationError, "Configuration invalid: #{errors.join(', ')}"
       end
     end
-
-    def log_invalid_template(exception)
-      @logger.error("Failed to render #{exception.filename}")
-
-      debug_msg = ColorizedString.new("Invalid template: #{exception.filename}\n").red
-      debug_msg += "> Error message:\n#{FormattedLogger.indent_four(exception.to_s)}"
-      if exception.content
-        debug_msg += "\n> Template content:\n#{FormattedLogger.indent_four(exception.content)}"
-      end
-      @logger.summary.add_paragraph(debug_msg)
-    end
   end
 end

test/fixtures/invalid/secret.yaml.erb

@@ -0,0 +1,10 @@
+<%- invalid_secret_with_newlines = Base64.encode64("*" * 70) -%>
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: invalid-secret
+type: Opaque
+data:
+  username: YWRtaW4=
+  password: <%= invalid_secret_with_newlines %>

test/integration/render_task_test.rb

@@ -234,6 +234,19 @@ def test_render_runtime_error_when_rendering
     ], in_order: true)
   end
 
+  def test_render_runtime_error_when_rendering_secrets
+    render = build_render_task(
+      File.join(fixture_path('invalid'), 'secret.yaml.erb')
+    )
+    assert_render_failure(render.run(stream: mock_output_stream))
+    assert_logs_match_all([
+      /Invalid template: secret.yaml.erb/,
+      "> Error message:",
+      /\(<rendered> secret.yaml.erb\): could not find expected ':' while scanning a simple key at line \d+ column \d+/,
+      "> Template content: Suppressed because it may contain a Secret",
+    ], in_order: true)
+  end
+
   def test_render_empty_template_dir
     tmp_dir = Dir.mktmpdir
     render = build_render_task(tmp_dir)