Hide secrets in logs. Fixes #8685

[anilkumar-pcs]

Fixes #8685

Introduced environment variable ARGO_REDACT_POD_LOGS to filter and mask secrets in workflow logs.

Logs when running examples/secrets.yaml workflow with no redaction

secrets-tdwm7: time="2022-10-19T12:47:54.251Z" level=info msg="capturing logs" argo=true
secrets-tdwm7: secret from env: S00perS3cretPa55word
secrets-tdwm7: secret from file: S00perS3cretPa55word
secrets-tdwm7: time="2022-10-19T12:47:55.263Z" level=info msg="sub-process exited" argo=true error="<nil>"

Logs when running examples/secrets.yaml workflow with redaction enabled

secrets-tdwm7: time="2022-10-19T12:47:54.251Z" level=info msg="capturing logs" [ redacted ]=true
secrets-tdwm7: secret from env: [ redacted ]
secrets-tdwm7: secret from file: [ redacted ]
secrets-tdwm7: time="2022-10-19T12:47:55.263Z" level=info msg="sub-process exited" [ redacted ]=true error="<nil>"

Please do not open a pull request until you have checked ALL of these:

• [x] Create the PR as draft .
• [x] Run make pre-commit -B to fix codegen and lint problems.
• [x] Sign-off your commits (otherwise the DCO check will fail).
• [x] Use a conventional commit message (otherwise the commit message check will fail).
• [x] "Fixes #" is in both the PR title (for release notes) and this description (to automatically link and close the issue).
• [x] Add unit or e2e tests. Say how you tested your changes. If you changed the UI, attach screenshots.
• [x] Github checks are green.
• [x] Once required tests have passed, mark your PR "Ready for review".

If changes were requested, and you've made them, dismiss the review to get it reviewed again.

[anilkumar-pcs]

@alexec @terrytangyuan Can one of you review the changes?

[alexec]

This is cool. I wonder if it can be even smarter? E.g. auto-detect secrets using a regex?

[anilkumar-pcs]

@alexec while the idea to auto-detect the secrets is nice, secrets are something user configurable and they can be literally anything. I believe it would be difficult to have a regex to identify all possible secrets.

Do you have any references in mind? Please share your thoughts.

[anilkumar-pcs]

@alexec I have introduced configuration as it was suggested in here

We can remove the env variable configuration and mask the secrets by default. WDYT?

[anilkumar-pcs]

@alexec made changes to remove the env configuration and masking secrets by default.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If this is a mentoring request, please provide an update here. Thank you for your contributions.

[stale[bot]]

This issue has been closed due to inactivity. Feel free to re-open if you still encounter this issue.