Sensitive output fix (#82)

* fix input restriction bug

* mark raw output sensitive

Co-authored-by: Tim Miller <tim.miller@risk.lexisnexis.com>

output.tf

@@ -25,50 +25,51 @@ output "effective_outbound_ips_ids" {
 
 output "kube_config" {
   description = "kubernetes config to be used by kubectl and other compatible tools"
-  value = (var.rbac.ad_integration ?
-  azurerm_kubernetes_cluster.aks.kube_admin_config.0 : azurerm_kubernetes_cluster.aks.kube_config.0)
+  value       = (var.rbac.ad_integration ?
+    azurerm_kubernetes_cluster.aks.kube_admin_config.0 : azurerm_kubernetes_cluster.aks.kube_config.0)
 }
 
 output "kube_config_raw" {
   description = "raw kubernetes config to be used by kubectl and other compatible tools"
-  value = (var.rbac.ad_integration ?
-  azurerm_kubernetes_cluster.aks.kube_admin_config_raw : azurerm_kubernetes_cluster.aks.kube_config_raw)
+  sensitive   = true
+  value       = (var.rbac.ad_integration ?
+    azurerm_kubernetes_cluster.aks.kube_admin_config_raw : azurerm_kubernetes_cluster.aks.kube_config_raw)
 }
 
 output "host" {
   description = "kubernetes host"
-  value = (var.rbac.ad_integration ?
-  azurerm_kubernetes_cluster.aks.kube_admin_config.0.host : azurerm_kubernetes_cluster.aks.kube_config.0.host)
+  value       = (var.rbac.ad_integration ?
+    azurerm_kubernetes_cluster.aks.kube_admin_config.0.host : azurerm_kubernetes_cluster.aks.kube_config.0.host)
 }
 
 output "username" {
   description = "kubernetes username"
-  value = (var.rbac.ad_integration ?
-  azurerm_kubernetes_cluster.aks.kube_admin_config.0.username : azurerm_kubernetes_cluster.aks.kube_config.0.username)
+  value       = (var.rbac.ad_integration ?
+    azurerm_kubernetes_cluster.aks.kube_admin_config.0.username : azurerm_kubernetes_cluster.aks.kube_config.0.username)
 }
 
 output "password" {
   description = "kubernetes password"
-  value = (var.rbac.ad_integration ?
-  azurerm_kubernetes_cluster.aks.kube_admin_config.0.password : azurerm_kubernetes_cluster.aks.kube_config.0.password)
+  value       = (var.rbac.ad_integration ?
+    azurerm_kubernetes_cluster.aks.kube_admin_config.0.password : azurerm_kubernetes_cluster.aks.kube_config.0.password)
 }
 
 output "client_certificate" {
   description = "kubernetes client certificate"
-  value = (var.rbac.ad_integration ?
-  azurerm_kubernetes_cluster.aks.kube_admin_config.0.client_certificate : azurerm_kubernetes_cluster.aks.kube_config.0.client_certificate)
+  value       = (var.rbac.ad_integration ?
+    azurerm_kubernetes_cluster.aks.kube_admin_config.0.client_certificate : azurerm_kubernetes_cluster.aks.kube_config.0.client_certificate)
 }
 
 output "client_key" {
   description = "kubernetes client key"
-  value = (var.rbac.ad_integration ?
-  azurerm_kubernetes_cluster.aks.kube_admin_config.0.client_key : azurerm_kubernetes_cluster.aks.kube_config.0.client_key)
+  value       = (var.rbac.ad_integration ?
+    azurerm_kubernetes_cluster.aks.kube_admin_config.0.client_key : azurerm_kubernetes_cluster.aks.kube_config.0.client_key)
 }
 
 output "cluster_ca_certificate" {
   description = "kubernetes cluster ca certificate"
-  value = (var.rbac.ad_integration ?
-  azurerm_kubernetes_cluster.aks.kube_admin_config.0.cluster_ca_certificate : azurerm_kubernetes_cluster.aks.kube_config.0.cluster_ca_certificate)
+  value       = (var.rbac.ad_integration ?
+    azurerm_kubernetes_cluster.aks.kube_admin_config.0.cluster_ca_certificate : azurerm_kubernetes_cluster.aks.kube_config.0.cluster_ca_certificate)
 }
 
 output "principal_id" {