-
Notifications
You must be signed in to change notification settings - Fork 152
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Redact commands and args while logging Pod manifest #1200
Conversation
Signed-off-by: Prasad Ghangal <prasad.ghangal@gmail.com>
Signed-off-by: Prasad Ghangal <prasad.ghangal@gmail.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Co-authored-by: Pavan Navarathna <pavan@kasten.io>
|
||
// SafeDumpPodObject redacts commands and args in Pod manifest to hide sensitive info, | ||
// converts Pod object into string and returns it | ||
func SafeDumpPodObject(pod *v1.Pod) string { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This function modifies pod
. Either:
- it should be noted in the function documentation; or
- the function should create a deep copy.
This is not an issue in the current usage of this function. But, if the function were to be reused elsewhere, this is surprising behavior and it may actually introduce software defects (a.k.a bugs).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That makes sense. Thanks a lot for letting me know. I will keep that in mind. Also, will fix this in the follow-up
Change Overview
This PR adds a helper function that can be used to log pod object manifest safely by hiding the commands and args field values which can hold sensitive info.
Pull request type
Please check the type of change your PR introduces:
Test Plan