shreemaan-abhishek opened a new pull request, #2892: URL: https://github.com/apache/apisix-ingress-controller/pull/2892
Follow-up to #2808, which redacted the ADC sync path (`Resources`, `Task`, `ADCServerRequest`) but left a few sites that still serialize plugin config and whole CRD objects into the log sink. ### Sites | Site | What leaked | Verbosity | |---|---|---| | `translator/gateway.go` `fillPluginsFromGatewayProxy` | whole `GatewayProxy.spec.plugins[].config` map | V(1) | | `translator/gateway.go` `fillPluginMetadataFromGatewayProxy` | raw `spec.pluginMetadata` JSON on unmarshal failure | **ERROR (default)** | | `translator/gateway.go` `fillPluginMetadataFromGatewayProxy` | parsed `pluginMetadata` config | V(1) | | `httproute_controller.go` (2 delete paths) | full `HTTPRoute`, incl. inline `RequestHeaderModifier` header values | **ERROR (default)** | | `consumer_controller.go` | full `Gateway` object | **ERROR (default)** | Plugin config is arbitrary user JSON. Kafka SASL passwords, logger tokens and OIDC client secrets all live there, so a reader with `pods/log` (weaker than `secrets/get`) picks them up from routine failure paths. ### Fix `Plugins`, `GlobalRule` and `PluginMetadata` implement `logr.Marshaler` and emit only sorted plugin names. That covers every present and future site that logs a plugin map centrally, rather than patching call sites one at a time. As in #2808, this is `MarshalLog`, not `MarshalJSON`: these exact values are serialized onto the wire to the ADC server, so redacting in `MarshalJSON` would corrupt the data-plane payload. `MarshalLog` affects logging only. The two CRD-object sites log `utils.NamespacedName(...)` instead, matching the identity-only convention already used everywhere else in those files (`httproute_controller.go:309` already did). ### Test `api/adc/redaction_test.go` drives the real zapr + zap console encoder into a buffer and asserts, for all three plugin-map types, that the config value is absent while the plugin names survive for debugging. A companion test asserts `json.Marshal` still emits the config, locking in that the wire payload is untouched. Verified non-vacuous: renaming the three `MarshalLog` methods fails all three subtests with `plugin config leaked into logs`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
