shreemaan-abhishek opened a new pull request, #2808:
URL: https://github.com/apache/apisix-ingress-controller/pull/2808
## What this PR does
Several controller log sites serialize whole, secret-bearing objects, so
credentials end up in controller stdout / log aggregation on routine paths
(a weaker boundary than `secrets/get` RBAC). This redacts them.
### Leaks fixed
- **AdminKey** (`ADCServerOpts.Token`): the ADC request body was logged
verbatim
at `V(1)` in `buildHTTPRequest`, printing the plaintext admin key.
- **TLS private keys & consumer credentials** (`adctypes.Resources`): `Task`
logging at ERROR (`store insert/delete failed`) and `V(1)` (`updating
config`)
dumped `SSL.Certificates[].Key` and consumer credential material.
- **Inline plugin credentials**: controllers logged full `ApisixConsumer`,
`Consumer`, `ApisixRoute`, `ApisixGlobalRule` and filtered `HTTPRoute`
objects,
whose specs can carry inline plugin config (key-auth key, hmac/jwt
secrets).
- **Raw credential/plugin blobs**: the consumer translator logged the raw
credential/plugin JSON on unmarshal errors.
- **Global-rule plugin config**: the store logged full global-rule items
(logger-plugin tokens).
### Approach
- Add `MarshalLog` (`logr.Marshaler`) to `adctypes.Resources`, `client.Task`
and
`ADCServerRequest`. These emit identity + counts, and `[REDACTED]` for the
token, never secret bodies. `MarshalLog` affects **logging only** - the
JSON
actually sent to the data plane is untouched (a `MarshalJSON`-based
redaction
would have corrupted the wire payload, which is why it is not used here).
- Log only `NamespacedName` / identity at the controller, provider,
translator
and store sites.
### Tests
`internal/adc/client/redaction_test.go` builds the production logger
(`zapr` + zap console encoder) into a buffer, logs a `Task` and an
`ADCServerRequest` populated with a TLS key, a consumer credential and an
admin
key, and asserts none of the secrets appear in the output while identity
still
does. It also asserts the request's real `Token` field is unchanged after
logging.
```
go test ./internal/adc/client/ -run MarshalLog -v
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
