Security : at startup, configuration secrets are printed on log.Info() output

[ngc104]

Context

https://github.com/prymitive/karma/blob/main/internal/config/config.go#L424-L430

	out, _ := yaml.Marshal(cfg)
	log.Info().Msg("Parsed configuration:")
	scanner := bufio.NewScanner(bytes.NewReader(out))
	for scanner.Scan() {
		log.Info().Msg(scanner.Text())
	}
}

This prints the configuration on the log console (in Kubernetes, I can read it with kubectl logs <karma pod>)

Security problem

In my configuration, I have secrets for authentication on alertmanagers.

My secrets are printed there.

Fix suggestions

Here are suggestions of how this problem could be fixed.

• print the configuration only in debug mode
• parse the configuration lines where secrets can be, and replace them with stars (example : ... level=info msg=" Authorization: Bearer *************************")
• don't print the configuration al all
• put the configuration in variables and print the variable contents instead of the plain configuration file

[prymitive]

You can disable logging configuration via cli flags or config option - https://github.com/prymitive/karma/blob/main/docs/CONFIGURATION.md#log

I’ll add sanitising of logged values of header map, it’s already done for other fields that contain secrets.