WIP Experiment in handling Sensitive keys

[notnoop]

Nomad has sensitive keys (e.g. ACL/Vault/Consul tokens) that Nomad ought not to log or expose in HTTP. One approach is to wrap the values in types such that they get redacted when logged.

Here, I attempt this approach to report early feedback and finding.

In this implementation, I introduce Sensitive string wrapper that is automatically redacted when logged and serialized in json but not when persisted in client state or RPC responses. To access the value, one must use the Plaintext() method to access value.

My experience has been relatively mixed:

• We have many sensitive values that get persisted and returned in APIs (e.g. ACL Tokens is the clear example)
  • Some sensitive keys are never persisted or passed around (e.g. replication/consul/telemetry tokens).
• Redaction on logging but not on API response is quite accidental.
  • HCLLog uses encoding/json while agent http handler and persistence uses ugorji/go for serialization.
  • Use use serialization to pass values to auxiliary processes (e.g. external drivers) and we may need to pass some sensitive tokens
  • when using the same library, it's not trivial to redacted based on context.

Though the approach is neat, given that we pass secrets around in RPC, I am not fully convinced this is useful as it is.

Some possible next steps:

• introduce a Secret level for values that should only be stored in memory and never persisted or returned in API/RPC.
• Change app such that we only expose a secret id once and never again.
  • allowing users to list and query for token secretID provides an additional escalation vector when combined with another data leakage (see CVE-2019-12741: ACL Privilege Escalation in Nomad #6430).
  • ???

[github-actions]

I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.