Don't log the value of --password if given (ko-build#458)

Dentrax · Oct 1, 2021 · b9cd759 · b9cd759
1 parent 688ca47
commit b9cd759
Showing 1 changed file with 12 additions and 1 deletion.
diff --git a/pkg/commands/create.go b/pkg/commands/create.go
@@ -90,7 +90,7 @@ func addCreate(topLevel *cobra.Command) {
 			// remaining flags passed after '--'.
 			argv := []string{"apply", "-f", "-"}
 			if kflags := kf.Values(); len(kflags) != 0 {
-				skflags := strings.Join(kflags, " ")
+				skflags := strings.Join(stripPassword(kflags), " ")
 				log.Printf(kubectlFlagsWarningTemplate,
 					"create", skflags,
 					"create", skflags)
@@ -147,3 +147,14 @@ func addCreate(topLevel *cobra.Command) {
 
 	topLevel.AddCommand(create)
 }
+
+func stripPassword(flags []string) []string {
+	cp := make([]string, len(flags))
+	for _, f := range flags {
+		if strings.HasPrefix(f, "--password=") {
+			f = "--password=REDACTED"
+		}
+		cp = append(cp, f)
+	}
+	return cp
+}