Skip to content

Commit 8ddb4e3

Browse files
FedosinFedosin
authored
[cinder-csi-plugin] Sanitize secrets in the requests (kubernetes#1471)
This PR uses the common lib to strip credentials in the logs. Fixes #kubernetes#1469
1 parent cb8ed03 commit 8ddb4e3

File tree

4 files changed

+87
-12
lines changed

4 files changed

+87
-12
lines changed

‎pkg/csi/cinder/controllerserver.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
"github.com/gophercloud/gophercloud/openstack/blockstorage/v3/snapshots"
2626
ossnapshots "github.com/gophercloud/gophercloud/openstack/blockstorage/v3/snapshots"
2727
"github.com/gophercloud/gophercloud/openstack/blockstorage/v3/volumes"
28+
"github.com/kubernetes-csi/csi-lib-utils/protosanitizer"
2829
"golang.org/x/net/context"
2930
"google.golang.org/grpc/codes"
3031
"google.golang.org/grpc/status"
@@ -41,7 +42,7 @@ type controllerServer struct {
4142
}
4243

4344
func (cs *controllerServer) CreateVolume(ctx context.Context, req *csi.CreateVolumeRequest) (*csi.CreateVolumeResponse, error) {
44-
klog.V(4).Infof("CreateVolume: called with args %+v", *req)
45+
klog.V(4).Infof("CreateVolume: called with args %+v", protosanitizer.StripSecrets(*req))
4546

4647
// Volume Name
4748
volName := req.GetName()
@@ -142,7 +143,7 @@ func (cs *controllerServer) CreateVolume(ctx context.Context, req *csi.CreateVol
142143
}
143144

144145
func (cs *controllerServer) DeleteVolume(ctx context.Context, req *csi.DeleteVolumeRequest) (*csi.DeleteVolumeResponse, error) {
145-
klog.V(4).Infof("DeleteVolume: called with args %+v", *req)
146+
klog.V(4).Infof("DeleteVolume: called with args %+v", protosanitizer.StripSecrets(*req))
146147

147148
// Volume Delete
148149
volID := req.GetVolumeId()
@@ -537,7 +538,7 @@ func (cs *controllerServer) ControllerGetVolume(context.Context, *csi.Controller
537538
}
538539

539540
func (cs *controllerServer) ControllerExpandVolume(ctx context.Context, req *csi.ControllerExpandVolumeRequest) (*csi.ControllerExpandVolumeResponse, error) {
540-
klog.V(4).Infof("ControllerExpandVolume: called with args %+v", *req)
541+
klog.V(4).Infof("ControllerExpandVolume: called with args %+v", protosanitizer.StripSecrets(*req))
541542

542543
volumeID := req.GetVolumeId()
543544
if len(volumeID) == 0 {

‎pkg/csi/cinder/nodeserver.go‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525

2626
"github.com/container-storage-interface/spec/lib/go/csi"
2727
"github.com/gophercloud/gophercloud/openstack/blockstorage/v3/volumes"
28+
"github.com/kubernetes-csi/csi-lib-utils/protosanitizer"
2829
"golang.org/x/net/context"
2930
"google.golang.org/grpc/codes"
3031
"google.golang.org/grpc/status"
@@ -47,7 +48,7 @@ type nodeServer struct {
4748
}
4849

4950
func (ns *nodeServer) NodePublishVolume(ctx context.Context, req *csi.NodePublishVolumeRequest) (*csi.NodePublishVolumeResponse, error) {
50-
klog.V(4).Infof("NodePublishVolume: called with args %+v", *req)
51+
klog.V(4).Infof("NodePublishVolume: called with args %+v", protosanitizer.StripSecrets(*req))
5152

5253
volumeID := req.GetVolumeId()
5354
source := req.GetStagingTargetPath()
@@ -226,7 +227,7 @@ func nodePublishEphermeral(req *csi.NodePublishVolumeRequest, ns *nodeServer) (*
226227
}
227228

228229
func nodePublishVolumeForBlock(req *csi.NodePublishVolumeRequest, ns *nodeServer, mountOptions []string) (*csi.NodePublishVolumeResponse, error) {
229-
klog.V(4).Infof("NodePublishVolumeBlock: called with args %+v", *req)
230+
klog.V(4).Infof("NodePublishVolumeBlock: called with args %+v", protosanitizer.StripSecrets(*req))
230231

231232
volumeID := req.GetVolumeId()
232233
targetPath := req.GetTargetPath()
@@ -265,7 +266,7 @@ func nodePublishVolumeForBlock(req *csi.NodePublishVolumeRequest, ns *nodeServer
265266
}
266267

267268
func (ns *nodeServer) NodeUnpublishVolume(ctx context.Context, req *csi.NodeUnpublishVolumeRequest) (*csi.NodeUnpublishVolumeResponse, error) {
268-
klog.V(4).Infof("NodeUnPublishVolume: called with args %+v", *req)
269+
klog.V(4).Infof("NodeUnPublishVolume: called with args %+v", protosanitizer.StripSecrets(*req))
269270

270271
volumeID := req.GetVolumeId()
271272
targetPath := req.GetTargetPath()
@@ -348,7 +349,7 @@ func nodeUnpublishEphermeral(req *csi.NodeUnpublishVolumeRequest, ns *nodeServer
348349
}
349350

350351
func (ns *nodeServer) NodeStageVolume(ctx context.Context, req *csi.NodeStageVolumeRequest) (*csi.NodeStageVolumeResponse, error) {
351-
klog.V(4).Infof("NodeStageVolume: called with args %+v", *req)
352+
klog.V(4).Infof("NodeStageVolume: called with args %+v", protosanitizer.StripSecrets(*req))
352353

353354
stagingTarget := req.GetStagingTargetPath()
354355
volumeCapability := req.GetVolumeCapability()
@@ -414,7 +415,7 @@ func (ns *nodeServer) NodeStageVolume(ctx context.Context, req *csi.NodeStageVol
414415
}
415416

416417
func (ns *nodeServer) NodeUnstageVolume(ctx context.Context, req *csi.NodeUnstageVolumeRequest) (*csi.NodeUnstageVolumeResponse, error) {
417-
klog.V(4).Infof("NodeUnstageVolume: called with args %+v", *req)
418+
klog.V(4).Infof("NodeUnstageVolume: called with args %+v", protosanitizer.StripSecrets(*req))
418419

419420
volumeID := req.GetVolumeId()
420421
if len(volumeID) == 0 {
@@ -474,7 +475,7 @@ func (ns *nodeServer) NodeGetCapabilities(ctx context.Context, req *csi.NodeGetC
474475
}
475476

476477
func (ns *nodeServer) NodeGetVolumeStats(_ context.Context, req *csi.NodeGetVolumeStatsRequest) (*csi.NodeGetVolumeStatsResponse, error) {
477-
klog.V(4).Infof("NodeGetVolumeStats: called with args %+v", *req)
478+
klog.V(4).Infof("NodeGetVolumeStats: called with args %+v", protosanitizer.StripSecrets(*req))
478479

479480
volumeID := req.GetVolumeId()
480481
if len(volumeID) == 0 {
@@ -518,7 +519,7 @@ func (ns *nodeServer) NodeGetVolumeStats(_ context.Context, req *csi.NodeGetVolu
518519
}
519520

520521
func (ns *nodeServer) NodeExpandVolume(ctx context.Context, req *csi.NodeExpandVolumeRequest) (*csi.NodeExpandVolumeResponse, error) {
521-
klog.V(4).Infof("NodeExpandVolume: called with args %+v", *req)
522+
klog.V(4).Infof("NodeExpandVolume: called with args %+v", protosanitizer.StripSecrets(*req))
522523

523524
volumeID := req.GetVolumeId()
524525
if len(volumeID) == 0 {

‎pkg/csi/cinder/utils.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"strings"
66

77
"github.com/container-storage-interface/spec/lib/go/csi"
8+
"github.com/kubernetes-csi/csi-lib-utils/protosanitizer"
89
"golang.org/x/net/context"
910
"google.golang.org/grpc"
1011
"k8s.io/cloud-provider-openstack/pkg/csi/cinder/openstack"
@@ -78,12 +79,12 @@ func ParseEndpoint(ep string) (string, string, error) {
7879

7980
func logGRPC(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
8081
klog.V(3).Infof("GRPC call: %s", info.FullMethod)
81-
klog.V(5).Infof("GRPC request: %+v", req)
82+
klog.V(5).Infof("GRPC request: %+v", protosanitizer.StripSecrets(req))
8283
resp, err := handler(ctx, req)
8384
if err != nil {
8485
klog.Errorf("GRPC error: %v", err)
8586
} else {
86-
klog.V(5).Infof("GRPC response: %+v", resp)
87+
klog.V(5).Infof("GRPC response: %+v", protosanitizer.StripSecrets(resp))
8788
}
8889
return resp, err
8990
}

‎pkg/csi/cinder/utils_test.go‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,15 @@ limitations under the License.
1717
package cinder
1818

1919
import (
20+
"bytes"
21+
"context"
22+
"flag"
2023
"testing"
2124

25+
"github.com/container-storage-interface/spec/lib/go/csi"
26+
"google.golang.org/grpc"
27+
"k8s.io/klog/v2"
28+
2229
"github.com/stretchr/testify/assert"
2330
)
2431

@@ -74,3 +81,68 @@ func TestParseEndpoint(t *testing.T) {
7481
_, _, err = ParseEndpoint("")
7582
assert.NotNil(t, err)
7683
}
84+
85+
func TestLogGRPC(t *testing.T) {
86+
// SET UP
87+
klog.InitFlags(nil)
88+
if e := flag.Set("logtostderr", "false"); e != nil {
89+
t.Error(e)
90+
}
91+
if e := flag.Set("alsologtostderr", "false"); e != nil {
92+
t.Error(e)
93+
}
94+
if e := flag.Set("v", "100"); e != nil {
95+
t.Error(e)
96+
}
97+
flag.Parse()
98+
99+
buf := new(bytes.Buffer)
100+
klog.SetOutput(buf)
101+
102+
handler := func(ctx context.Context, req interface{}) (interface{}, error) { return nil, nil }
103+
info := grpc.UnaryServerInfo{
104+
FullMethod: "fake",
105+
}
106+
107+
tests := []struct {
108+
name string
109+
req interface{}
110+
expStr string
111+
}{
112+
{
113+
"with secrets",
114+
&csi.NodeStageVolumeRequest{
115+
VolumeId: "vol_1",
116+
Secrets: map[string]string{
117+
"account_name": "k8s",
118+
"account_key": "testkey",
119+
},
120+
XXX_sizecache: 100,
121+
},
122+
`GRPC request: {"secrets":"***stripped***","volume_id":"vol_1"}`,
123+
},
124+
{
125+
"without secrets",
126+
&csi.ListSnapshotsRequest{
127+
StartingToken: "testtoken",
128+
},
129+
`GRPC request: {"starting_token":"testtoken"}`,
130+
},
131+
}
132+
133+
for _, test := range tests {
134+
t.Run(test.name, func(t *testing.T) {
135+
// EXECUTE
136+
_, _ = logGRPC(context.Background(), test.req, &info, handler)
137+
klog.Flush()
138+
139+
// ASSERT
140+
assert.Contains(t, buf.String(), "GRPC call: fake")
141+
assert.Contains(t, buf.String(), test.expStr)
142+
assert.Contains(t, buf.String(), "GRPC response: null")
143+
144+
// CLEANUP
145+
buf.Reset()
146+
})
147+
}
148+
}

0 commit comments

Comments
 (0)