Skip to content
This repository has been archived by the owner on Jul 26, 2022. It is now read-only.

fix: redact sensitive information from logs #859

Merged
merged 3 commits into from
Oct 26, 2021

Conversation

moolen
Copy link
Member

@moolen moolen commented Oct 25, 2021

This PR redacts log output from the vault backend. The vault token and/or k8s jwt tokens are logged which shouldn't be the case.

config/index.js Outdated Show resolved Hide resolved
@moolen
Copy link
Member Author

moolen commented Oct 26, 2021

What i did to test it:

Deploy the following es, start the application and observe the logs. There is no need to run a vault at all.

apiVersion: 'kubernetes-client.io/v1'
kind: ExternalSecret
metadata:
  name: vault
spec:
  backendType: vault
  vaultRole: my-vault-role
  kvVersion: 2 # defaults to 2
  data:
    - name: password
      key: secret/data/hello-service/password
      property: password
    - name: cert.p12
      key: secret/data/hello-service/certificates
      property: cert.p12
      isBinary: true # defaults to false

This is what's logged then:

{
   "level":50,
   "message_time":"2021-10-26T09:09:36.322Z",
   "pid":699618,
   "hostname":"inca",
   "payload":{
      "err":{
         "type":"RequestError",
         "message":"Error: connect ECONNREFUSED 127.0.0.1:8200",
         "stack":"...some stacktrace...",
         "name":"RequestError",
         "cause":{
            "type":"Error",
            "message":"connect ECONNREFUSED 127.0.0.1:8200",
            # ...
         },
         "error":{
            "type":"Error",
            "message":"connect ECONNREFUSED 127.0.0.1:8200",
            # ...
         },
         "options":{
            "json":{
               "role":"my-vault-role",
               "jwt":"[Redacted]" // <--- here
            },
            # ...
            "headers":"[Redacted]", // <--- headers are completely redacted
         }
      }
   },
   "msg":"failure while polling the secret default/vault"
}

@moolen moolen merged commit 79da8cb into external-secrets:master Oct 26, 2021
@moolen moolen deleted the hotfix/redact-logs branch October 26, 2021 10:19
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants