api: redact more fields.#9692
Conversation
Signed-off-by: Piotr Sikora <piotrsikora@google.com>
mergeconflict
left a comment
mergeconflict
left a comment
There was a problem hiding this comment.
Are you thinking to add tests similar to SecretManagerImplTest::ConfigDumpHandler?
Signed-off-by: Piotr Sikora <piotrsikora@google.com>
Not really, no... Extensive testing for protos annotated with |
|
pieces that i'm famliar with are already redacted, so lgtm just curious whats the |
It's the configuration for the asynchronous private key provider, which, in principle, may contain the private key itself, or an information on how to perform the signing. I consider this information sensitive. |
htuch
left a comment
htuch
left a comment
There was a problem hiding this comment.
LGTM, thanks. I think we don't have to be perfect here, only grow the number of sites we annotate and encourage folks to use these going forward. Config dump and logs are still sensitive and contain PII, so we are not making any assertions around them being scrubbed of all sensitive data.
…more_fields Signed-off-by: Piotr Sikora <piotrsikora@google.com>
|
This won't make for a great git history, but presumably this can be still merged after the freeze? |
|
Yeah, sensitive annotations are not breaking. By freezing, we just mean that we won't do breaking changes as per policy. |
| // Private key method provider specific configuration. | ||
| oneof config_type { | ||
| google.protobuf.Struct config = 2 [deprecated = true]; | ||
| google.protobuf.Struct config = 2 [deprecated = true, (udpa.annotations.sensitive) = true]; |
There was a problem hiding this comment.
Doesn't this effectively not do anything since redaction doesn't work inside the struct?
There was a problem hiding this comment.
No, this works fine: it recursively redacts everything inside the struct.
The case that wouldn't work is if the struct weren't annotated as sensitive, but contained some field that, if it were part of a strongly-typed message, would have been annotated sensitive. That is, when we're looking inside the struct, we have no info about which fields should be redacted.
There was a problem hiding this comment.
OK got it. Since this is a struct that gets converted into a strongly typed message everything works. 👍
6 participants
Signed-off-by: Piotr Sikora piotrsikora@google.com