Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

kafka-gitops should never output passwords #96

Open
oocx opened this issue Sep 30, 2022 · 2 comments · Fixed by joschi/kafka-gitops#49
Open

kafka-gitops should never output passwords #96

oocx opened this issue Sep 30, 2022 · 2 comments · Fixed by joschi/kafka-gitops#49

Comments

@oocx
Copy link

oocx commented Sep 30, 2022

When I run kafka-gitops with -v, it outputs username and password in plain text:

kafka-gitops-grxt4 kafka-gitops 07:02:35.026 [main] INFO com.devshawn.kafka.gitops.config.KafkaGitopsConfigLoader - Kafka Config: {sasl.mechanism=PLAIN, sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="my-username" password="my-password";, bootstrap.servers=..., sasl.enabled.mechanisms=PLAIN, client.id=kafka-gitops}

If I run kafka-gitops as part of a job in our kubernetes cluster, the password will end up in our log files.

kafka-gitops should never print credentials to avoid leaking them to logs.

joschi added a commit to joschi/kafka-gitops that referenced this issue Oct 19, 2022
Sanitize the `sasl.jaas.config` configuration setting before printing it and replace the configured password with a placeholder.

Fixes devshawn#96
joschi added a commit to joschi/kafka-gitops that referenced this issue Oct 19, 2022
Sanitize the `sasl.jaas.config` configuration setting before printing it and replace the configured password with a placeholder.

Fixes devshawn#96
@joschi
Copy link

joschi commented Oct 19, 2022

Duplicates #93

@joschi
Copy link

joschi commented Oct 19, 2022

@oocx If you're still interested, this issue should have been fixed in https://github.com/joschi/kafka-gitops/releases/tag/0.2.16.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants