Don't print sensitive data to the operator log while generating the operator's internal REST identity

Author: moreaut

src/scripts/initialize-internal-operator-identity.sh

@@ -2,7 +2,8 @@
 # Copyright 2018, Oracle Corporation and/or its affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
 
-set -x
+# do not turn on 'set -x' since it can print sensitive info, like secrets and private keys, to the oeprator log
+#set -x
 
 if [ "$#" != 0 ] ; then
   1>&2 echo "Syntax: ${BASH_SOURCE[0]}"
@@ -95,31 +96,37 @@ function recordInternalIdentity {
   TOKEN=`cat /var/run/secrets/kubernetes.io/serviceaccount/token`
   KUBERNETES_MASTER="https://kubernetes.default.svc"
 
+  # the request body prints out the atz token
+  # don't specify -v so that the token is not printed to the operator log
+
+  # the response body from PATCH prints out the config map / secret
+  # send stdout to /dev/null to supress this so that we don't print the cert or private key to the operator log
+
   # put the new certificate in the operator's config map so that it will be available
   # the next time the operator is started
   NEW_CERT=`cat ${INTERNAL_CERT_BASE64_PEM}`
   PATCH_DOCUMENT="{ \"data\": { \"${CERT_PROPERTY}\" : \"${NEW_CERT}\" } }"
   curl \
-    -v \
     --cacert $CACERT \
     -H "Authorization: Bearer $TOKEN" \
     -H "Content-Type: application/merge-patch+json" \
     -d "${PATCH_DOCUMENT}" \
     -X PATCH \
-    $KUBERNETES_MASTER/api/v1/namespaces/$NAMESPACE/configmaps/weblogic-operator-cm
+    $KUBERNETES_MASTER/api/v1/namespaces/$NAMESPACE/configmaps/weblogic-operator-cm \
+    > /dev/null
 
   # put the new private key in the operator's secret so that it will be available
   # the next time the operator is started
   NEW_KEY=`base64 -i ${INTERNAL_KEY_PEM} | tr -d '\n'`
   PATCH_DOCUMENT="{ \"data\": { \"${KEY_PROPERTY}\" : \"${NEW_KEY}\" } }"
   curl \
-    -v \
     --cacert $CACERT \
     -H "Authorization: Bearer $TOKEN" \
     -H "Content-Type: application/merge-patch+json" \
     -d "${PATCH_DOCUMENT}" \
     -X PATCH \
-    $KUBERNETES_MASTER/api/v1/namespaces/$NAMESPACE/secrets/weblogic-operator-secrets
+    $KUBERNETES_MASTER/api/v1/namespaces/$NAMESPACE/secrets/weblogic-operator-secrets \
+    > /dev/null
 }
 
 function createInternalIdentity {