Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

never log secrets #1

Merged
merged 6 commits into from
Nov 30, 2018
Merged

never log secrets #1

merged 6 commits into from
Nov 30, 2018

Commits on Nov 29, 2018

  1. Makefile: initial version for packages

    Just adds the usual all/clean/test targets for whatever packages
    are going to be added later.
    pohly committed Nov 29, 2018
    Configuration menu
    Copy the full SHA
    a761933 View commit details
    Browse the repository at this point in the history

Commits on Nov 30, 2018

  1. protosanitizer: log messages without secrets

    When running at glog level >= 5, CSI sidecar apps log the full
    CreateVolumeRequest, including the secrets. Secrets should never be
    logged at any level to avoid accidentally exposing them.
    
    We need to filter out the secrets. With older CSI versions, that could
    have been done based on the field name, which is still an option
    should this get backported. With CSI 1.0, a custom field option marks
    fields as secret. Using that option has the advantage that the code
    will continue to work also when new secret fields get added in the
    future.
    
    For the sake of simplicity, JSON is now used as representation of the
    string instead of the former compact text format from gRPC. That makes
    it possible to strip values from a map with generic types, instead of
    having to copy and manipulate the real generated structures.
    
    Another option would have been to copy
    https://github.com/golang/protobuf/blob/master/proto/text.go and
    modify it so that it skips secret fields, but that's over 800 lines of
    code.
    
    This version of the code is identical to the one reviewed in
    kubernetes-csi/external-provisioner#171 with
    the backwards parameters in
    assert.NotContains (kubernetes-csi/external-provisioner#171 (review))
    fixed.
    pohly committed Nov 30, 2018
    Configuration menu
    Copy the full SHA
    179d6f9 View commit details
    Browse the repository at this point in the history
  2. protosanitizer: test marshaling of arrays and maps

    No code changes required because json handles those types for us, but
    it's still good to have a test case for it.
    pohly committed Nov 30, 2018
    Configuration menu
    Copy the full SHA
    43143fa View commit details
    Browse the repository at this point in the history
  3. protosanitizer: another test for oneof

    During PR review there were concerns about support for oneof fields,
    with this example suggested as test case.
    pohly committed Nov 30, 2018
    Configuration menu
    Copy the full SHA
    af584b9 View commit details
    Browse the repository at this point in the history
  4. protosanitizer: only overwrite secret fields if already set

    The previous version was adding "secrets: *** strippped ***"
    even when the "secrets" field was unset.
    pohly committed Nov 30, 2018
    Configuration menu
    Copy the full SHA
    663368c View commit details
    Browse the repository at this point in the history
  5. protosanitizer: test with updated CSI spec

    This is a copy of the CSI 1.0.0 spec and build rules with more fields
    added that test various special cases, in particular the addition of
    secrets in nested data structures (simple structs, lists, maps).
    pohly committed Nov 30, 2018
    Configuration menu
    Copy the full SHA
    2333c94 View commit details
    Browse the repository at this point in the history