Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

change TRUNCATED to DATA+OMITTED in kubectl config view #66023

Merged
merged 1 commit into from Aug 18, 2018
Merged

change TRUNCATED to DATA+OMITTED in kubectl config view #66023

merged 1 commit into from Aug 18, 2018

Conversation

ibrasho
Copy link
Contributor

@ibrasho ibrasho commented Jul 10, 2018 •
edited

What this PR does / why we need it:
Based on the discussion in #61573, this PR switches the replacement text for CA certificate data and client certificates and secrets printed using kubectl config view. Currently, REDACTED is used, which might give a false impression that the data is a secret (which is not true for the public certificates).

This PR changes REDACTED to DATA+OMITTED. The printed string is the base64 encoded string on the byte stream. Some trickery is involved to print a readable string (refer to this comment for more info).

Which issue(s) this PR fixes:
Fixes #61573

Special notes for your reviewer:

Release note:

Switched certificate data replacement from "REDACTED" to "DATA+OMITTED"

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jul 10, 2018
@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jul 10, 2018
sethvargo
sethvargo reviewed Jul 10, 2018
View reviewed changes
staging/src/k8s.io/client-go/tools/clientcmd/api/helpers.go Outdated
@@ -27,8 +27,8 @@ import (
)

func init() {
sDec, _ := base64.StdEncoding.DecodeString("REDACTED+")
redactedBytes = []byte(string(sDec))
sDec, _ := base64.StdEncoding.DecodeString("DATA+OMITTED")
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we actually want to keep both of these. The ClientKeyData should definitely remain as REDACTED+, since it's actually a secret.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd argue that other secrets like AuthInfos[*].Token and AuthInfos[*].Password should be redacted too. What do you think?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would agree, but that's not my call to make 😄

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, I've thought about it, and I think we should scope this PR to just change the public CA to be DATA+OMITTED. We can open another PR about the other fields.

It's not my call (I'm not on a sig/* group), but I think that's the best way to avoid contention.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure.

@ibrasho ibrasho force-pushed the change-TRUNCATED-to-DATA+OMITTED branch from 4342b8c to 07d204d Compare July 11, 2018 06:59
@ibrasho ibrasho force-pushed the change-TRUNCATED-to-DATA+OMITTED branch from 07d204d to d3aac46 Compare July 20, 2018 11:50
@k8s-ci-robot k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 20, 2018
@sethvargo
Copy link

LGTM

@dims
Copy link
Member

dims commented Jul 31, 2018

/ok-to-test

@k8s-ci-robot k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jul 31, 2018
@ibrasho ibrasho force-pushed the change-TRUNCATED-to-DATA+OMITTED branch from d3aac46 to dac8cf6 Compare August 1, 2018 00:16
@k8s-ci-robot k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Aug 1, 2018
@ibrasho ibrasho force-pushed the change-TRUNCATED-to-DATA+OMITTED branch 2 times, most recently from 3ecb1b5 to abe5539 Compare August 1, 2018 00:20
@ibrasho
Copy link
Contributor Author

ibrasho commented Aug 1, 2018

/test pull-kubernetes-bazel-test

@ibrasho
Copy link
Contributor Author

ibrasho commented Aug 1, 2018

/assign @caesarxuchao

@ibrasho
change TRUNCATED to DATA+OMITTED in kubectl config view
23996b2 
Signed-off-by: Ibrahim AshShohail <me@ibrasho.com>
@ibrasho
Copy link
Contributor Author

ibrasho commented Aug 1, 2018

/retest

@ibrasho ibrasho force-pushed the change-TRUNCATED-to-DATA+OMITTED branch from abe5539 to 23996b2 Compare August 1, 2018 00:40
@ibrasho
Copy link
Contributor Author

ibrasho commented Aug 1, 2018

Unrelated failures?

@sethvargo
Copy link

All the test failures seem unrelated to me

@sethvargo
Copy link

@ibrasho thanks for doing this work. What do we need to do to get this into a release?

@caesarxuchao
Copy link
Member

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 17, 2018
@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 17, 2018
@caesarxuchao
Copy link
Member

/retest

@yliaog
Copy link
Contributor

yliaog commented Aug 17, 2018

/lgtm

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: caesarxuchao, ibrasho, yliaog

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@fejta-bot
Copy link

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel comment for consistent failures.

@k8s-github-robot
Copy link

/test all

Tests are more than 96 hours old. Re-running tests.

@k8s-github-robot
Copy link

/test all [submit-queue is verifying that this PR is safe to merge]

@k8s-github-robot
Copy link

Automatic merge from submit-queue (batch tested with PRs 60790, 66023, 67549). If you want to cherry-pick this change to another branch, please follow the instructions here.

@k8s-github-robot k8s-github-robot merged commit ae9beb4 into kubernetes:master Aug 18, 2018
@neolit123
Copy link
Member

/sig api-machinery
for the release note tool.

@k8s-ci-robot k8s-ci-robot added the sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. label Aug 24, 2018
@liggitt liggitt mentioned this pull request Sep 13, 2018
Closed
@ibrasho ibrasho mentioned this pull request Jan 14, 2019
Closed
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sethvargo sethvargo sethvargo left review comments

@lavalamp lavalamp Awaiting requested review from lavalamp

@yliaog yliaog Awaiting requested review from yliaog

Assignees

@caesarxuchao caesarxuchao

@yliaog yliaog

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Remove use of REDACTED in config output for public CA
9 participants
@ibrasho @sethvargo @dims @caesarxuchao @yliaog @k8s-ci-robot @fejta-bot @k8s-github-robot @neolit123