Prometheus doesn't elide all secrets in config

[brian-brazil]

The way we're hiding secrets in configs is based on a regex that hides the secret as long as it's on the same line as the field name.

This breaks if the secret is spread across multiple lines, such as is common with SSL certs.

We should either hide secrets in all cases, or in no cases to avoid giving a false sense of security.

The proper way to do this would be to re-marshall the YAML with secrets elided. This will however lose all comments, as there doesn't appear to be a Go YAML library that preserves comments.
On the minor plus side we'd be more likely to notice certain rare YAML formatting mistakes.

[fabxc]

We have/had support for this via a dedicated `Secret` type and never ended up using it for that exact reason of comments and newlines being removed. Seems like we should re-evaluate whether we are willing to make the tradeoff vs. hacking around with regexes further.

…

On Mon, May 15, 2017 at 4:24 PM Brian Brazil ***@***.***> wrote: The way we're hiding secrets in configs is based on a regex that hides the secret as long as it's on the same line as the field name. This breaks if the secret is spread across multiple lines, such as is common with SSL certs. We should either hide secrets in all cases, or in no cases to avoid giving a false sense of security. The proper way to do this would be to re-marshall the YAML with secrets elided. This will however lose all comments, as there doesn't appear to be a Go YAML library that preserves comments. On the minor plus side we'd be more likely to notice certain rare YAML formatting mistakes. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#2722>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AEuA8l8bJoT6qpsm0podOMoB7A4ynEtKks5r6GAJgaJpZM4NbNSL> .

[brian-brazil]

I don't think we can do much more with regexes, as we're getting into writing our own parser at that stage.

[mxinden]

👍 for using dedicated Secret type. Let me know if I can help here and implement it, as it is blocking #2711 a little as well.

[brian-brazil]

Okay, lacking a better alternative it looks like we'll be offering up a re-marshalled config without comments.

I suggest keeping the docs around this broad enough that they'll cover a future switch to something with comments.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.