Clickhouse operator credentials with special characters lead to error and password leakage

Hi,

we are using the official helm chart for deployment of the clickhouse operator.

We tried providing the credentials to be used by the operator to connect to ClickHouse instances via values.yaml file and the element configs.files.config.yaml:

    ################################################
    ##
    ## Access to ClickHouse instances
    ##
    ################################################
    access:
      # Possible values for scheme are:
      # 1. http
      # 2. https
      scheme: ""
      # ClickHouse credentials (username, password and port) to be used by the operator to connect to ClickHouse instances.
      # Used for:
      # 1. Metrics requests
      # 2. Schema maintenance
      # 3. DROP DNS CACHE
      # User with these credentials can be specified in additional ClickHouse .xml config files,
      # located in clickhouse.configuration.file.path.user folder
      # username: ""
      # password: ""
      # rootCA: ""
      # Location of the k8s Secret with username and password to be used by the operator to connect to ClickHouse instances.
      # Can be used instead of explicitly specified username and password which are:
      # clickhouse.access.username
      # clickhouse.access.password
      # Secret should have two keys:
      # 1. username
      # 2. password
      secret:
        # Empty namespace means that k8s secret would be looked in the same namespace where operator's pod is running.
        namespace: ""
        # Empty name means no k8s Secret would be looked for
        name: "ch-operator-secrets"
      # Port where to connect to ClickHouse instances to
      port: 8123

This leads to the operator pulling the username and password for the clickhouse operator out of the ch-operator-secrets secret in the same namespace and trying to use it in the fashion: http://username:password@clickhouse_cluster_node/somequery.

We observed two problems:

1. Using '%' characters in the password leads to errors regarding % not properly being escaped + leaking the whole connection string including username and password to the logs
2. A password without % leads to:
   Err: parse "http://operator:passs": invalid port ":passs" after host
   where 'operator' is the username and 'passs' are the first five characters of the password provided by the secret.

We were not able to get the credentials from the k8s secret working, as the password is always recognized as the port in the http basic auth.

We would assume that we can just provide the username and password via the secret without any special escape characters.

Is there a way to fix this?

The issues occurred with the most up2date version up to now (0.20.3)

Thank you!

EDIT:
We tried a password without any special characters (#, %, etc..) - so only letters and numbers - this also fixes the second case.
Nevertheless special characters should be possible in passwords + in error cases the password shouldn't be leaked.

Start by tracing how credentials from the ch-operator-secrets Kubernetes Secret are used to build the ClickHouse connection URL and how connection errors are logged. Reproduce the issue with passwords containing % and other special characters, then verify that authentication succeeds and logs never include the username, password, or full connection string.