[containerapp] Hide containerapps and jobs env vars on create and update

src/containerapp/HISTORY.rst

@@ -9,6 +9,10 @@ upcoming
 * 'az containerapp compose create': fixed an issue where the environment's resource group was not resolved from --environment when the input value was a resource id.
 * 'az containerapp replica count', returns the replica count of a container app
 * [Breaking Change] 'az containerapp job create': add default values for container app job properties --replica-completion-count, --replica-retry-limit, --replica-timeout, --parallelism, --min-executions, --max-executions, --polling-interval
+* 'az containerapp create': hide environment variables
+* 'az containerapp update': hide environment variables
+* 'az containerapp job create': hide environment variables
+* 'az containerapp job update': hide environment variables
 
 0.3.41
 ++++++

src/containerapp/azext_containerapp/_transformers.py

@@ -3,7 +3,7 @@
 # Copyright (c) Microsoft Corporation. All rights reserved.
 # Licensed under the MIT License. See License.txt in the project root for license information.
 # --------------------------------------------------------------------------------------------
-
+from azure.cli.command_modules.containerapp._utils import safe_get
 
 def transform_containerapp_output(app):
     props = ['name', 'location', 'resourceGroup', 'provisioningState']
@@ -17,6 +17,38 @@ def transform_containerapp_output(app):
     return result
 
 
+def clean_up_sensitive_values(response_json):
+    for container in safe_get(response_json, "properties", "template", "containers", default=[]):
+        if "env" in container:
+            for env in container["env"]:
+                if env.get("value"):
+                    del env["value"]
+
+    if safe_get(response_json, "properties", "template") and "scale" in response_json["properties"]["template"]:
+        for rule in safe_get(response_json, "properties", "template", "scale", "rules", default=[]):
+            for (key, val) in rule.items():
+                if key != "name":
+                    val["metadata"] = dict((k, "") for k, v in val["metadata"].items())
+
+    return response_json
+
+
+def transform_sensitive_values_wrapper():
+
+    def transform_sensitive_values(response_json):
+        return clean_up_sensitive_values(response_json)
+
+    return transform_sensitive_values
+
+
+def transform_sensitive_values_list_output_wrapper():
+
+    def transform_sensitive_values_list_output(apps):
+        return [clean_up_sensitive_values(a) for a in apps]
+
+    return transform_sensitive_values_list_output
+
+
 def transform_containerapp_list_output(apps):
     return [transform_containerapp_output(a) for a in apps]
 

src/containerapp/azext_containerapp/commands.py

@@ -13,18 +13,21 @@
                             transform_job_execution_list_output,
                             transform_job_execution_show_output,
                             transform_revision_list_output,
-                            transform_revision_output, transform_usages_output)
+                            transform_revision_output, 
+                            transform_usages_output,
+                            transform_sensitive_values_wrapper,
+                            transform_sensitive_values_list_output_wrapper)
 
 
 def load_command_table(self, _):
     with self.command_group('containerapp') as g:
         g.custom_show_command('show', 'show_containerapp', table_transformer=transform_containerapp_output)
         g.custom_command('list', 'list_containerapp', table_transformer=transform_containerapp_list_output)
-        g.custom_command('create', 'create_containerapp', supports_no_wait=True, exception_handler=ex_handler_factory(), table_transformer=transform_containerapp_output)
-        g.custom_command('update', 'update_containerapp', supports_no_wait=True, exception_handler=ex_handler_factory(), table_transformer=transform_containerapp_output)
+        g.custom_command('create', 'create_containerapp', supports_no_wait=True, exception_handler=ex_handler_factory(), table_transformer=transform_containerapp_output, transform=transform_sensitive_values_wrapper())
+        g.custom_command('update', 'update_containerapp', supports_no_wait=True, exception_handler=ex_handler_factory(), table_transformer=transform_containerapp_output, transform=transform_sensitive_values_wrapper())
         g.custom_command('delete', 'delete_containerapp', supports_no_wait=True, confirmation=True, exception_handler=ex_handler_factory())
         g.custom_command('exec', 'containerapp_ssh', validator=validate_ssh)
-        g.custom_command('up', 'containerapp_up', supports_no_wait=False, exception_handler=ex_handler_factory())
+        g.custom_command('up', 'containerapp_up', supports_no_wait=False, exception_handler=ex_handler_factory(), transform=transform_sensitive_values_wrapper())
         g.custom_command('browse', 'open_containerapp_in_browser')
         g.custom_show_command('show-custom-domain-verification-id', 'show_custom_domain_verification_id', is_preview=True)
         g.custom_command('list-usages', 'list_usages', table_transformer=transform_usages_output, is_preview=True)
@@ -50,9 +53,9 @@ def load_command_table(self, _):
     with self.command_group('containerapp job') as g:
         g.custom_show_command('show', 'show_containerappsjob')
         g.custom_command('list', 'list_containerappsjob')
-        g.custom_command('create', 'create_containerappsjob', supports_no_wait=True, exception_handler=ex_handler_factory())
+        g.custom_command('create', 'create_containerappsjob', supports_no_wait=True, exception_handler=ex_handler_factory(), transform=transform_sensitive_values_wrapper())
         g.custom_command('delete', 'delete_containerappsjob', supports_no_wait=True, confirmation=True, exception_handler=ex_handler_factory())
-        g.custom_command('update', 'update_containerappsjob', supports_no_wait=True, exception_handler=ex_handler_factory())
+        g.custom_command('update', 'update_containerappsjob', supports_no_wait=True, exception_handler=ex_handler_factory(), transform=transform_sensitive_values_wrapper())
         g.custom_command('start', 'start_containerappsjob', supports_no_wait=True, exception_handler=ex_handler_factory())
         g.custom_command('stop', 'stop_containerappsjob', supports_no_wait=True, exception_handler=ex_handler_factory())
 

src/containerapp/azext_containerapp/tests/latest/test_containerapp_scenario.py

@@ -206,6 +206,8 @@ def test_container_acr(self, resource_group):
             JMESPathCheck('properties.template.scale.minReplicas', '0'),
             JMESPathCheck('properties.template.scale.maxReplicas', '1'),
             JMESPathCheck('length(properties.template.containers[0].env)', 1),
+            JMESPathCheck('properties.template.containers[0].env[0].name', "testenv"),
+            JMESPathCheck('properties.template.containers[0].env[0].value', None),
         ])
 
         # Add secrets to Container App with ACR