Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Removes the risk of sending decrypted EJSON secrets to output. #431

Merged
merged 1 commit into from
Feb 27, 2019
Merged

Removes the risk of sending decrypted EJSON secrets to output. #431

merged 1 commit into from
Feb 27, 2019

Commits on Feb 27, 2019

  1. Removes the risk of sending decrypted ejson secrets to output. 

    Presently, if a 'kubectl apply' fails when updating EJSON secrets, it's
possible that the decrypted secrets payload can be output as part of the
error message.

This should be avoided since it can expose all secrets of your application.

This change takes a simple approach by not including the error message in
commands where it is possible to display the payload. The 'Kubectl' class
does not log messages if the sensitive flag is set to true, however the
EjsonSecretProvisioner class raises EjsonSecretError which is logged
further up the stack.
    @stantona
    stantona committed Feb 27, 2019
    Configuration menu
    Copy the full SHA
    a59c733 View commit details
    Browse the repository at this point in the history