Skip to content

feat(secrets): mask secrets in logs #254

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ecrupper merged 13 commits into from
Jan 6, 2022
Merged

feat(secrets): mask secrets in logs #254

Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
a67d9cd
initial changes
ecrupper Dec 16, 2021
d62f6eb
add some replace logic for secret masking
ecrupper Dec 21, 2021
cad68d1
Merge branch 'master' into feat/mask-secrets-logs
ecrupper Dec 21, 2021
b92ecb1
bringing in new types
ecrupper Dec 21, 2021
f0206e2
Merge branch 'feat/mask-secrets-logs' of github.com:go-vela/worker in…
ecrupper Dec 21, 2021
ef400b5
fix go mod validate
ecrupper Dec 21, 2021
1d445eb
Merge branch 'master' into feat/mask-secrets-logs
jbrockopp Dec 23, 2021
6a0e676
multi line compatibility and initial testing work
ecrupper Dec 27, 2021
be1afbd
Merge branch 'feat/mask-secrets-logs' of github.com:go-vela/worker in…
ecrupper Dec 27, 2021
74a54ca
added testing for internal secret masking
ecrupper Dec 28, 2021
b22c38d
Merge branch 'master' into feat/mask-secrets-logs
ecrupper Dec 28, 2021
be97338
add back accidental deletion of error checking
ecrupper Jan 6, 2022
4cf8256
Merge branch 'feat/mask-secrets-logs' of github.com:go-vela/worker in…
ecrupper Jan 6, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
add some replace logic for secret masking
  • Loading branch information
@ecrupper
ecrupper committed Dec 21, 2021
commit d62f6eb3ee6a9955feba6faeff7abafb1b5c2dab
45 changes: 12 additions & 33 deletions executor/linux/step.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -217,25 +217,15 @@ func (c *client) StreamStep(ctx context.Context, ctn *pipeline.Container) error

secretValues := []string{}

for _, secret := range c.pipeline.Secrets {
// ignore pulling secrets coming from plugins
if !secret.Origin.Empty() {
continue
}

c.Logger.Infof("pulling %s %s secret %s", secret.Engine, secret.Type, secret.Name)

s, err := c.secret.pull(secret)
for _, secret := range ctn.Secrets {
s := ctn.Environment[strings.ToUpper(secret.Target)]
if err != nil {
c.err = err
return fmt.Errorf("unable to pull secrets: %w", err)
}
secretValues = append(secretValues, s.GetValue())
secretValues = append(secretValues, s)
}

fmt.Println("LOGGING LOGGING LOGGING")
fmt.Println(secretValues)

defer func() {
// tail the runtime container
rc, err := c.Runtime.TailContainer(ctx, ctn)
Expand All @@ -261,19 +251,16 @@ func (c *client) StreamStep(ctx context.Context, ctn *pipeline.Container) error
return
}

// overwrite the existing log with all bytes
//
// https://pkg.go.dev/github.com/go-vela/types/library?tab=doc#Log.SetData
// mask secrets in logs before setting them in the database.
strData := string(data)
fmt.Println("LOG")
fmt.Println(strData)
for _, secret := range secretValues {
fmt.Println("SECRET DEFER:")
fmt.Println(secret)
strData = strings.ReplaceAll(strData, secret, "********")
strData = strings.ReplaceAll(strData, secret, constants.SecretLogMask)
}
data = []byte(strData)

// overwrite the existing log with all bytes
//
// https://pkg.go.dev/github.com/go-vela/types/library?tab=doc#Log.SetData
_log.SetData(data)

logger.Debug("uploading logs")
Expand Down Expand Up @@ -338,13 +325,9 @@ func (c *client) StreamStep(ctx context.Context, ctn *pipeline.Container) error
//
// https://pkg.go.dev/github.com/go-vela/types/library?tab=doc#Log.AppendData

strData := string(logs.Bytes())
fmt.Println("LOG")
fmt.Println(strData)
strData := logs.String()
for _, secret := range secretValues {
fmt.Println("SECRET TIME CHUNK:")
fmt.Println(secret)
strData = strings.ReplaceAll(strData, secret, "********")
strData = strings.ReplaceAll(strData, secret, constants.SecretLogMask)
}

_log.AppendData([]byte(strData))
Expand Down Expand Up @@ -407,13 +390,9 @@ func (c *client) StreamStep(ctx context.Context, ctn *pipeline.Container) error
// update the existing log with the new bytes
//
// https://pkg.go.dev/github.com/go-vela/types/library?tab=doc#Log.AppendData
strData := string(logs.Bytes())
fmt.Println("LOG")
fmt.Println(strData)
strData := logs.String()
for _, secret := range secretValues {
fmt.Println("SECRET BYTE CHUNK:")
fmt.Println(secret)
strData = strings.ReplaceAll(strData, secret, "********")
strData = strings.ReplaceAll(strData, secret, constants.SecretLogMask)
}
_log.AppendData(logs.Bytes())

Expand Down