argoproj / argoproj/argo-workflows
Sensitive parameters
- Dominant language
- Go
- Stars
- 17k
- Forks
- 3.7k
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 138
Description
# Summary
Add the ability to flag parameters/arguments/variables whether input, or output as sensitive, and ensure that their values don't appear in the UI, CLI, or log output.
# Use Cases
Some operations take in values that are sensitive, or output sensitive values dynamically that would not make sense to be created as a Kubernetes secret. When providing access to the UI to development teams, or less privileged users these values should not be exposed.
I know nothing about the Argo code, but I'm thinking that a boolean `sensitive` field could be added to the `Parameter` object, and be used at the appropriate logging/rendering locations to do the filtering perhaps?
---
**Message from the maintainers**:
Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.
Contributor guide
Research direction
Start by tracing the Parameter object and the UI, CLI, and log output paths named in the issue. Determine how input and output values flow through those surfaces; done means values marked sensitive are consistently hidden while ordinary values remain visible.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- backend, cli, frontend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100