"st2 key load secrets.yaml" prints out secret values to terminal when ran.

SUMMARY

st2 key load will log secrets to the terminal unlike st2 key set -e which encrypts then logs them to the terminal.

STACKSTORM VERSION

Paste the output of st2 --version:
st2 3.8.0, on Python 3.8.16

OS, environment, install method

• Ubuntu
• Ansible Playbooks https://docs.stackstorm.com/install/ansible.html

Steps to reproduce the problem

Given that a file secrets.yaml exists on the client machine:

---
- name: api_token
  value: SECRET_TOKEN  # cleartext
  secret: true  # will be stored encrypted

When running st2 key load secrets.yaml the contents of the secret variables will be logged to the console in plain text.

This is unlike st2 key set -e api_token $api_token which logs the encrypted value of api_token.

For doing deployments of variables to the key store in CI/CD environments this can lead to secret leakage.

Expected Results

st2 key load secrets.yaml encrypts the secrets and prints the encrypted value.

Actual Results

st2 key load secrets.yaml displays secrets in plain text.

Start by tracing the CLI entry points for st2 key load and compare their output handling with st2 key set -e. Reproduce the command using the provided secrets.yaml example, then verify that secret values are encrypted before any terminal output and that the displayed value is no longer plaintext.