origin icon indicating copy to clipboard operation
origin copied to clipboard

OCPBUGS-42618: Replace RunHostCmd with Exec function to censor bearer token being ex…

Open Shilpa-Gokul opened this issue 1 year ago • 29 comments
trafficstars

RunHostCmd function from getBearerTokenURLViaPod function was invoking the kubectl exec to execute a command from within a pod which eventually led to printing this line containing the bearer token. As a result the CI logs was removed as it contained sensitive information exposure. Since it was difficult to make the changes upstream to avoid printing the token, replaced the RunHostCmd function with a new Exec function where we have the privilege to decide what needs to be printed in the output.

Shilpa-Gokul avatar Oct 10 '24 06:10 Shilpa-Gokul

@Shilpa-Gokul: This pull request references Jira Issue OCPBUGS-42618, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.18.0) matches configured target version for branch (4.18.0)
  • bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact: /cc @juliemathew

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

RunHostCmd function from getBearerTokenURLViaPod function was invoking the kubectl exec to execute a command from within a pod which eventually led to printing this line containing the bearer token. As a result the CI logs was removed as it contained sensitive information exposure. Since it was difficult to make the changes upstream to avoid printing the token, replaced the RunHostCmd function with a new Exec function where we have the privilege to decide what needs to be printed in the output.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot avatar Oct 10 '24 09:10 openshift-ci-robot

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

Shilpa-Gokul avatar Oct 10 '24 09:10 Shilpa-Gokul

@Shilpa-Gokul: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/4c62cca0-86e9-11ef-8776-9b0b0a8473a1-0

openshift-ci[bot] avatar Oct 10 '24 09:10 openshift-ci[bot]

/lgtm

tvardema avatar Oct 10 '24 19:10 tvardema

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

Shilpa-Gokul avatar Oct 11 '24 06:10 Shilpa-Gokul

@Shilpa-Gokul: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/98746b80-8798-11ef-9280-4f3665830d61-0

openshift-ci[bot] avatar Oct 11 '24 06:10 openshift-ci[bot]

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

Shilpa-Gokul avatar Oct 11 '24 10:10 Shilpa-Gokul

@Shilpa-Gokul: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/b3caf260-87bf-11ef-88bd-22b7b001175f-0

openshift-ci[bot] avatar Oct 11 '24 10:10 openshift-ci[bot]

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

Shilpa-Gokul avatar Oct 11 '24 12:10 Shilpa-Gokul

@Shilpa-Gokul: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/c5a5d310-87c9-11ef-9995-4d9c6ebc2f1a-0

openshift-ci[bot] avatar Oct 11 '24 12:10 openshift-ci[bot]

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

Shilpa-Gokul avatar Oct 15 '24 05:10 Shilpa-Gokul

@Shilpa-Gokul: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/3d315c90-8aba-11ef-94b7-bb30450ae71b-0

openshift-ci[bot] avatar Oct 15 '24 05:10 openshift-ci[bot]

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

Shilpa-Gokul avatar Oct 15 '24 12:10 Shilpa-Gokul

@Shilpa-Gokul: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/7fa4ac50-8aef-11ef-814a-6b867f01fde7-0

openshift-ci[bot] avatar Oct 15 '24 12:10 openshift-ci[bot]

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.18-ocp-e2e-ovn-remote-libvirt-ppc64le

Shilpa-Gokul avatar Oct 16 '24 05:10 Shilpa-Gokul

@Shilpa-Gokul: An error was encountered. No known errors were detected, please see the full error message for details.

Full error message. could not create PullRequestPayloadQualificationRun: client rate limiter Wait returned an error: context canceled

Please contact an administrator to resolve this issue.

openshift-ci[bot] avatar Oct 16 '24 05:10 openshift-ci[bot]

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

Shilpa-Gokul avatar Oct 16 '24 07:10 Shilpa-Gokul

@Shilpa-Gokul: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/d7d60bf0-8b92-11ef-8433-3c241ccd8260-0

openshift-ci[bot] avatar Oct 16 '24 07:10 openshift-ci[bot]

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.16-ocp-e2e-ovn-remote-libvirt-ppc64le

Shilpa-Gokul avatar Oct 16 '24 10:10 Shilpa-Gokul

@Shilpa-Gokul: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-multiarch-master-nightly-4.16-ocp-e2e-ovn-remote-libvirt-ppc64le

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/89e74130-8baa-11ef-9fcc-ef3b641fe46e-0

openshift-ci[bot] avatar Oct 16 '24 10:10 openshift-ci[bot]

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.18-ocp-e2e-ovn-remote-libvirt-ppc64le

Shilpa-Gokul avatar Oct 16 '24 10:10 Shilpa-Gokul

@Shilpa-Gokul: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-multiarch-master-nightly-4.18-ocp-e2e-ovn-remote-libvirt-ppc64le

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/91de2250-8baa-11ef-811f-f52c13701662-0

openshift-ci[bot] avatar Oct 16 '24 10:10 openshift-ci[bot]

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

Shilpa-Gokul avatar Oct 17 '24 08:10 Shilpa-Gokul

@Shilpa-Gokul: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-multiarch-master-nightly-4.17-ocp-e2e-ovn-remote-libvirt-ppc64le

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/78fa0380-8c5e-11ef-85e3-a9ad54a8e998-0

openshift-ci[bot] avatar Oct 17 '24 08:10 openshift-ci[bot]

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.15-ocp-e2e-ovn-remote-libvirt-s390x

Shilpa-Gokul avatar Oct 17 '24 08:10 Shilpa-Gokul

@Shilpa-Gokul: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-multiarch-master-nightly-4.15-ocp-e2e-ovn-remote-libvirt-s390x

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/dca4b150-8c5e-11ef-9363-bff65aa82d5b-0

openshift-ci[bot] avatar Oct 17 '24 08:10 openshift-ci[bot]

/payload-job periodic-ci-openshift-multiarch-master-nightly-4.15-ocp-e2e-ovn-remote-libvirt-s390x

Shilpa-Gokul avatar Oct 17 '24 13:10 Shilpa-Gokul

@Shilpa-Gokul: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-multiarch-master-nightly-4.15-ocp-e2e-ovn-remote-libvirt-s390x

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/d2721ef0-8c88-11ef-80bb-a8581eebfdd9-0

openshift-ci[bot] avatar Oct 17 '24 13:10 openshift-ci[bot]

Unable to trigger payload-job from this PR because the payload jobs are all triggered on build03 cluster and our host machines are accessible only from build01 cluster. As a result all payload jobs are failing with connection issue. So tested the changes locally and have attached the results in this comment. Could you please consider these results and review this PR? log1.txt log2.txt

Shilpa-Gokul avatar Oct 21 '24 12:10 Shilpa-Gokul

/assign

candita avatar Oct 23 '24 15:10 candita