Skip to content

Conversation

cveticm
Copy link
Collaborator

@cveticm cveticm commented Sep 5, 2025

Proposed changes

To allow users to see what credentials are being stored when running atlas config describe without exposing the data, a secure property will be set in secure storage with the actual value as well as in insecure storage with value "redacted".

In this way, users should not get confused if they get an Unauthorized error and check their config to see their keys are missing.

# profile shows secure properties with value redacted
> bin/atlas config describe profileName
SETTING         VALUE
auth_type       service_account
client_id       redacted
client_secret   redacted
org_id          b1234bcde5678fghi9012jk
output          plaintext
project_id      a1234bcde5678fghi9012jk
service         cloud

# secure credentials are correctly retrieved, allowing for successful api calls
> bin/atlas cluster list -P profileName
ID    NAME   MDB VER   STATE

# exporting credentials is not effected by this change
> export <credentials set to another project/org>
> bin/atlas cluster list -P profileName
ID                         NAME           MDB VER   STATE
12abc3456def7g8h8ee96d3f   Cluster11111   8.0.13    IDLE

Follow-up Actions

  • Bump core dep in AtlasCLI
  • Bump core dep in K8s Plugin

Checklist

@coveralls
Copy link

coveralls commented Sep 5, 2025

Coverage Status

coverage: 45.327% (+0.1%) from 45.206%
when pulling dd6e033 on fix_set_secure_as_redacted
into 18a1771 on master.

@cveticm cveticm marked this pull request as ready for review September 5, 2025 14:39
@cveticm cveticm requested a review from a team as a code owner September 5, 2025 14:39
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand what you're trying to do, but I don't think what you're trying to do belongs here.
Shouldn't this be part of the describe command instead?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes an alternative solution is to detect if the secure properties corresponding to the auth type are available and, if so, print <secure property>=redacted. Let's chat Moday

@cveticm
Copy link
Collaborator Author

cveticm commented Sep 8, 2025

Closing as alternative solution is being done here (core) and here (cli)

@cveticm cveticm closed this Sep 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants