dsconfig sub-command leaks admin password in the k8s control plane logs

[pearj]

The new dsconfig sub-command does a kubectl exec, which gets logged in it's entirety into the Kubernetes control plane logs. Which means the uid=admin password ends up visible in the logs.

forgeops/bin/commands/dsconfig

Lines 127 to 132 in 29dcd34

	dsconfig = f"dsconfig {conn_str} {user_str} {dsconfig_opts} {extra_opts}"
	cmd_opts = f"exec {namespace_opt} {params.pod} -- {dsconfig}"
	if params.debug or params.dryrun:
	print(f"{KUBECTL} {cmd_opts} {pass_str_red}")
	if not args.dryrun:
	utils.run(KUBECTL, f"{cmd_opts} {pass_str}")

In bash this can be easily fixed by switching to a heredoc and passing the command as a stdin to bash, I'm not 100% sure what the python equivalent is.

For example:

kubectl exec -n namespace ds-idrepo-0 -- dsconfig -h localhost -p 1636 --trustAll -D 'uid=admin' -w 'secret-password'

Becomes:

kubectl exec -n namespace ds-idrepo-0 -- bash << EOF
dsconfig -h localhost -p 1636 --trustAll -D 'uid=admin' -w 'secret-password'
EOF

The python equivalent might be (untested)

    cmd_opts = f"exec {namespace_opt} {params.pod} -- bash"
    dsconfig_with_pwd = f"{dsconfig} {pass_str}"
    if params.debug or params.dryrun:
        print(f"{KUBECTL} {cmd_opts} {dsconfig} {pass_str_red}")
    if not args.dryrun:
        utils.run(KUBECTL, f"{cmd_opts}", stdin=dsconfig_with_pwd)

[damonconway]

Hi @pearj ,
Thanks for pointing this out. I'm working on a fix.

Damon

[damonconway]

Ok, I have an internal PR to fix this. It should be in the next release. FYI, your fix was basically correct. It just needed a couple of extra things.

    dsconfig = f"dsconfig {conn_str} {user_str} {dsconfig_opts} {extra_opts}"
    cmd_opts = f"exec -i {namespace_opt} {params.pod} --"
    dsconfig_with_pwd = f"{dsconfig} {pass_str}"
    if params.debug or params.dryrun:
        print(f"{KUBECTL} {cmd_opts} {dsconfig} {pass_str_red}")
    if not params.dryrun:
        utils.run(KUBECTL, f"{cmd_opts} sh", stdin=dsconfig_with_pwd, text=True)