oxidecomputer / oxidecomputer/omicron
Don't print VolumeConstructionRequests without redacting keys
Open
@leftwo is already working on this.
Since Aug 19, 2024.
- Dominant language
- Rust
- Stars
- 572
- Forks
- 97
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 96
Description
An example log message from sled agent print out a VCR, which includes the encryption key:
disks: [DiskRequest { device: "nvme", name: "metrics-test-9a4478cf-4756-4bec-b7a8-744-4dda7b", read_only: false, slot: Slot(0), volume_construction_request: Volume { block_size: 512, id: fbe4320b-fc5e-438f-9b43-19267c7cdb30, read_only_parent: None, sub_volumes: [Region { block_size: 512, blocks_per_extent: 131072, extent_count: 64, gen: 3, opts: CrucibleOpts { cert_pem: None, control: None, flush_timeout: None, id: fbe4320b-fc5e-438f-9b43-19267c7cdb30, key: Some("<REDACTED_FOR_THE_ISSUE_BUT_EXISTS_IN_THE_REAL_OUTPUT>"), key_pem: None, lossy: false, read_only: false, root_cert_pem: None, target: ["[fd00:1122:3344:107::8]:19011", "[fd00:1122:3344:105::5]:19022", "[fd00:1122:3344:103::a]:19012"] } }] } }], cloud_init_bytes:
We should not print the key.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.