-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
App Pool Identity credentials show in clear text in INFO log #32
Comments
Thank you for bringing this up @torrick! I totally agree to redact that or at the least just log that there are credentials being passed but not THE credentials themselves. Working on this ASAP! |
So looking at how other nomad drivers log their inputs, I see where identity data became an info level log. This log is essentially to inform that the driver is starting with the set values, which seems to be a staple with other nomad drivers (log the driver configs, not secrets as none of them have secret level configs). Nomad assumes that anything set on the nomad job spec is not a secret with their workflows and rely on secrets being transferred via the Maybe something along the lines of Nomad does have an open issue with credentials being used within the nomad spec itself, but it seems to be in the discussion phase still. @shishir-a412ed and @torrick thoughts? |
@Vulfox Do we really need to print the entire driver config every time a task is started? If this information is for debugging purposes, then we can change Another option is to just make a separate copy of the struct and redact the password, and use the copy for logging purposes.
|
@shishir-a412ed it is not needed to log at info level for this part. I only set it at this level and with the whole driver config to match what hashicorp has done with their other drivers for consistency. I think we should lean to remove the app pool identity configs from the driver config or allow for it to be set elsewhere to provide a more secure solution for folks to use until hashicorp has the |
I'm currently using @Vulfox template -> env trick to populate the app pool identity secret bits so my main concern is just that they're written to the info log in clear text. Now the driver config written to the log has been super helpful in debugging some weird nomad string encoding issues so I'd keep it in but @shishir-a412ed's idea about copying the driver config struct would solve the immediate issue for me. Provided the additional struct doesn't doesn't make the codebase more confusing. |
When setting an app pool identity in the driver config, the entire driver config is written to the nomad log with INFO and the app pool identity username and password are visible in clear text. Is there a way we can redact that in the log?
The text was updated successfully, but these errors were encountered: