elastic / elastic/elastic-package

[FEAT] Add --ci flag to suppress serverless credentials in logs

Open
#3,029 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
72
Forks
141
Avg merge
19h 42m
Merged PRs (30d)
55

Description

### Is your feature request related to a problem? Please describe.
When running elastic-package stack up --provider serverless, the command creates a new serverless project and prints the admin username and password to the console upon completion.

While this is helpful for local development, it poses a significant security risk when running in automated CI/CD environments. CI logs are typically stored and are often accessible to a wider audience, which could lead to the exposure of sensitive credentials.

Example of current log output:
```bash
...
Elasticsearch host: https://elastic-package-test-serverless-security-d9de16.es.us-east-1.aws.elastic.cloud
Kibana host: https://elastic-package-test-serverless-security-d9de16.kb.us-east-1.aws.elastic.cloud
Username: admin
Password: Gt5PV31n6MO55yXXXX
...
```
Even though the environment may be ephemeral based on the CI logic and configuration, there is many cases where the CI may fail and leave the serverless project live with the credentials accessible to the public.

### Describe the solution you'd like
I propose the addition of a new flag to the elastic-package stack up command, for example, --ci.

When this flag is present, the command should perform its operations as normal but suppress the Username and Password from being printed to the standard output. The credentials should still be saved to the active profile so that subsequent commands in the CI pipeline (like elastic-package test) can execute successfully.

This would make running elastic-package in a CI context much more secure.

Describe alternatives you've considered
The alternative is to manually filter the log output using shell commands to remove the sensitive lines. However, this approach is cumbersome, error-prone, and not as clean as having a built-in option within the tool itself.

### Additional context
This feature is particularly important for teams leveraging CI/CD to test their custom packages against Elastic Serverless, ensuring that security best practices are maintained throughout the development lifecycle.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the elastic-package stack up command with --provider serverless, focusing on where credentials are printed and where the active profile is saved. Done means a --ci option suppresses the username and password in standard output while preserving credentials for later commands such as elastic-package test; add or run the relevant command tests if present.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.