younsl opened a new pull request, #233: URL: https://github.com/apache/superset-kubernetes-operator/pull/233
## Summary When a lifecycle task Job fails, the operator records a truncated failure message in the parent Superset status and Kubernetes Events. This output can contain fragments of the task's own stdout — for example a database driver error that embeds the full connection URI — which means credentials could leak to anyone with read access to the Superset CR, without needing Secret read permissions. This was documented as a known limitation in `docs/reference/security.md`. This PR closes most of that gap by applying best-effort pattern-based redaction to task failure messages before they are persisted. ## Details - New `redactCredentials()` in `internal/controller/redact.go` masks four credential shapes with `***`: passwords in URI userinfo (`scheme://user:password@host`, including empty-user forms like `redis://:pass@host`), HTTP `Authorization` header values (scheme word preserved, credential masked), bare bearer tokens (token must contain a digit so prose like "bearer authentication failed" is untouched), and free-form credential assignments (`password=`, `PGPASSWORD:`, `SECRET_KEY =`, `token=`, `api_key:`, `passphrase=`, etc.). - Redaction is applied at the two points where task output enters status: `jobFailureMessage()` and the stuck-pod path in `handleStuckTaskPod()`. Both feed `taskRef.Message`, which is the single source for the status condition and Warning Events, so all downstream surfaces are covered. - Redaction runs **before** truncation: truncating first could split a credential mid-pattern, leaving a fragment that no longer matches but still leaks. A regression test covers this ordering. - The URI password match is greedy up to the last `@` in the whitespace-delimited token, so a malformed password containing a raw `@` is masked in full rather than leaking its tail. The trade-off is possible over-masking of `@`-bearing query strings, which errs on the safe side. - The operator still never reads Secret values (no RBAC change), so redaction is by pattern rather than exact value. Fully keyless standalone secrets cannot be caught this way; `security.md` is updated to describe the mitigation and its limits instead of the previous unmitigated caveat. - Adds a `FuzzRedactCredentials` target (no-panic + idempotence properties, since the same message can pass through the function across reconciles) wired into `make fuzz` per the project fuzzing convention, plus table-driven unit tests including false-positive guards. - Not verified end-to-end against a real failing task Job in a cluster; the patterns are validated by unit tests against representative driver/HTTP error strings. Changelog entry added under Unreleased → Security. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
