Skip to content

Commit 265f7af

Browse files
SangJunBakSangJunBak
authored
mz-debug: Remove scraping secrets (#34223)
Even though redacted, we still leak some of the values via annotations. <!-- Describe the contents of the PR briefly but completely. If you write detailed commit messages, it is acceptable to copy/paste them here, or write "see commit messages for details." If there is only one commit in the PR, GitHub will have already added its commit message above. --> ### Motivation <!-- Which of the following best describes the motivation behind this PR? * This PR fixes a recognized bug. [Ensure issue is linked somewhere.] * This PR adds a known-desirable feature. [Ensure issue is linked somewhere.] * This PR fixes a previously unreported bug. [Describe the bug in detail, as if you were filing a bug report.] * This PR adds a feature that has not yet been specified. [Write a brief specification for the feature, including justification for its inclusion in Materialize, as if you were writing the original feature specification.] * This PR refactors existing code. [Describe what was wrong with the existing code, if it is not obvious.] --> ### Tips for reviewer <!-- Leave some tips for your reviewer, like: * The diff is much smaller if viewed with whitespace hidden. * [Some function/module/file] deserves extra attention. * [Some function/module/file] is pure code movement and only needs a skim. Delete this section if no tips. --> ### Checklist - [ ] This PR has adequate test coverage / QA involvement has been duly considered. ([trigger-ci for additional test/nightly runs](https://trigger-ci.dev.materialize.com/)) - [ ] This PR has an associated up-to-date [design doc](https://github.com/MaterializeInc/materialize/blob/main/doc/developer/design/README.md), is a design doc ([template](https://github.com/MaterializeInc/materialize/blob/main/doc/developer/design/00000000_template.md)), or is sufficiently small to not require a design. <!-- Reference the design in the description. --> - [ ] If this PR evolves [an existing `$T ⇔ Proto$T` mapping](https://github.com/MaterializeInc/materialize/blob/main/doc/developer/command-and-response-binary-encoding.md) (possibly in a backwards-incompatible way), then it is tagged with a `T-proto` label. - [ ] If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label ([example](MaterializeInc/cloud#5021)). <!-- Ask in #team-cloud on Slack if you need help preparing the cloud PR. --> - [ ] If this PR includes major [user-facing behavior changes](https://github.com/MaterializeInc/materialize/blob/main/doc/developer/guide-changes.md#what-changes-require-a-release-note), I have pinged the relevant PM to schedule a changelog post.
1 parent fa7b3d1 commit 265f7af

File tree

6 files changed

+27
-116
lines changed

6 files changed

+27
-116
lines changed

‎Cargo.lock‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎doc/user/data/mz-debug/kubernetes_resource_files.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ rows:
3030
- `roles/{namespace}/*.yaml`
3131
- `rolebinding/{namespace}/*.yaml`
3232
- `configmaps/{namespace}/*.yaml`
33-
- `secrets/{namespace}/*.yaml`
3433
- `serviceaccounts/{namespace}/*.yaml`
3534
3635
- "Resource Type": "Cluster-level"

‎doc/user/data/mz-debug/self_managed_options.yml‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,6 @@ rows:
3232
3333
Defaults to the `KUBERNETES_CONTEXT` environment variable.
3434
35-
- Option: "`--k8s-dump-secret-values <boolean>`"
36-
Description: |
37-
38-
<a name="k8s-dump-secret-values"></a> If `true`, include unredacted secrets in the
39-
dump. Use with caution.
40-
41-
Defaults to `false`.
42-
4335
- Option: "`-h`, `--help`"
4436
Description: |
4537

‎src/mz-debug/Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
[package]
22
name = "mz-debug"
33
description = "Debug tool for self-managed Materialize."
4-
version = "0.4.0"
4+
version = "0.4.1"
55
edition.workspace = true
66
rust-version.workspace = true
77
publish = false

‎src/mz-debug/src/k8s_dumper.rs‎

Lines changed: 25 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,7 @@ use k8s_openapi::api::admissionregistration::v1::{
2929
};
3030
use k8s_openapi::api::apps::v1::{DaemonSet, Deployment, ReplicaSet, StatefulSet};
3131
use k8s_openapi::api::core::v1::{
32-
ConfigMap, Event, Node, PersistentVolume, PersistentVolumeClaim, Pod, Secret, Service,
33-
ServiceAccount,
32+
ConfigMap, Event, Node, PersistentVolume, PersistentVolumeClaim, Pod, Service, ServiceAccount,
3433
};
3534
use k8s_openapi::api::networking::v1::NetworkPolicy;
3635
use k8s_openapi::api::rbac::v1::{Role, RoleBinding};
@@ -51,29 +50,22 @@ struct K8sResourceDumper<'n, K> {
5150
api: Api<K>,
5251
namespace: Option<String>,
5352
resource_type: String,
54-
dump_secret_values: bool,
5553
}
5654

5755
impl<'n, K> K8sResourceDumper<'n, K>
5856
where
5957
K: kube::Resource<DynamicType = ()> + Clone + Debug + Serialize + DeserializeOwned,
6058
{
61-
fn cluster(context: &'n Context, client: Client, dump_secret_values: bool) -> Self {
59+
fn cluster(context: &'n Context, client: Client) -> Self {
6260
Self {
6361
context,
6462
api: Api::<K>::all(client),
6563
namespace: None,
6664
resource_type: K::plural(&()).into_owned(),
67-
dump_secret_values,
6865
}
6966
}
7067

71-
fn namespaced(
72-
context: &'n Context,
73-
client: Client,
74-
namespace: String,
75-
dump_secret_values: bool,
76-
) -> Self
68+
fn namespaced(context: &'n Context, client: Client, namespace: String) -> Self
7769
where
7870
K: kube::Resource<Scope = NamespaceResourceScope>,
7971
{
@@ -82,7 +74,6 @@ where
8274
api: Api::<K>::namespaced(client, namespace.as_str()),
8375
namespace: Some(namespace),
8476
resource_type: K::plural(&()).into_owned(),
85-
dump_secret_values,
8677
}
8778
}
8879

@@ -115,12 +106,7 @@ where
115106
));
116107
let mut file = File::create(&file_name)?;
117108

118-
// If the resource is a secret, we hide its values by default.
119-
if self.resource_type == "secrets" && !self.dump_secret_values {
120-
serde_yaml::to_writer(&mut file, item.meta())?;
121-
} else {
122-
serde_yaml::to_writer(&mut file, &item)?;
123-
}
109+
serde_yaml::to_writer(&mut file, &item)?;
124110

125111
info!("Exported {}", file_name.display());
126112
}
@@ -145,8 +131,6 @@ pub struct K8sDumper<'n> {
145131
k8s_additional_namespaces: Option<Vec<String>>,
146132
/// The kubernetes context to use.
147133
k8s_context: Option<String>,
148-
/// If true, the tool will dump the values of secrets in the Kubernetes cluster.
149-
k8s_dump_secret_values: bool,
150134
}
151135

152136
impl<'n> K8sDumper<'n> {
@@ -156,15 +140,13 @@ impl<'n> K8sDumper<'n> {
156140
k8s_namespace: String,
157141
k8s_additional_namespaces: Option<Vec<String>>,
158142
k8s_context: Option<String>,
159-
k8s_dump_secret_values: bool,
160143
) -> Self {
161144
Self {
162145
context,
163146
client,
164147
k8s_namespace,
165148
k8s_additional_namespaces,
166149
k8s_context,
167-
k8s_dump_secret_values,
168150
}
169151
}
170152

@@ -239,59 +221,37 @@ impl<'n> K8sDumper<'n> {
239221

240222
/// Write cluster-level k8s resources to a yaml file per resource.
241223
async fn dump_cluster_resources(&self) {
242-
K8sResourceDumper::<Node>::cluster(
243-
self.context,
244-
self.client.clone(),
245-
self.k8s_dump_secret_values,
246-
)
247-
.dump()
248-
.await;
224+
K8sResourceDumper::<Node>::cluster(self.context, self.client.clone())
225+
.dump()
226+
.await;
249227

250-
K8sResourceDumper::<StorageClass>::cluster(
251-
self.context,
252-
self.client.clone(),
253-
self.k8s_dump_secret_values,
254-
)
255-
.dump()
256-
.await;
228+
K8sResourceDumper::<StorageClass>::cluster(self.context, self.client.clone())
229+
.dump()
230+
.await;
257231

258-
K8sResourceDumper::<PersistentVolume>::cluster(
259-
self.context,
260-
self.client.clone(),
261-
self.k8s_dump_secret_values,
262-
)
263-
.dump()
264-
.await;
232+
K8sResourceDumper::<PersistentVolume>::cluster(self.context, self.client.clone())
233+
.dump()
234+
.await;
265235

266236
K8sResourceDumper::<MutatingWebhookConfiguration>::cluster(
267237
self.context,
268238
self.client.clone(),
269-
self.k8s_dump_secret_values,
270239
)
271240
.dump()
272241
.await;
273242

274243
K8sResourceDumper::<ValidatingWebhookConfiguration>::cluster(
275244
self.context,
276245
self.client.clone(),
277-
self.k8s_dump_secret_values,
278-
)
279-
.dump()
280-
.await;
281-
K8sResourceDumper::<DaemonSet>::cluster(
282-
self.context,
283-
self.client.clone(),
284-
self.k8s_dump_secret_values,
285-
)
286-
.dump()
287-
.await;
288-
K8sResourceDumper::<CustomResourceDefinition>::cluster(
289-
self.context,
290-
self.client.clone(),
291-
self.k8s_dump_secret_values,
292246
)
293247
.dump()
294248
.await;
249+
K8sResourceDumper::<DaemonSet>::cluster(self.context, self.client.clone())
250+
.dump()
251+
.await;
252+
K8sResourceDumper::<CustomResourceDefinition>::cluster(self.context, self.client.clone())
253+
.dump()
254+
.await;
295255
}
296256

297257
async fn _dump_k8s_pod_logs(&self, namespace: &String) -> Result<(), anyhow::Error> {
@@ -370,115 +330,86 @@ impl<'n> K8sDumper<'n> {
370330

371331
/// Write namespace-level k8s resources to a yaml file per resource.
372332
pub async fn dump_namespaced_resources(&self, namespace: String) {
373-
K8sResourceDumper::<Pod>::namespaced(
374-
self.context,
375-
self.client.clone(),
376-
namespace.clone(),
377-
self.k8s_dump_secret_values,
378-
)
379-
.dump()
380-
.await;
333+
K8sResourceDumper::<Pod>::namespaced(self.context, self.client.clone(), namespace.clone())
334+
.dump()
335+
.await;
381336
K8sResourceDumper::<Service>::namespaced(
382337
self.context,
383338
self.client.clone(),
384339
namespace.clone(),
385-
self.k8s_dump_secret_values,
386340
)
387341
.dump()
388342
.await;
389343
K8sResourceDumper::<Deployment>::namespaced(
390344
self.context,
391345
self.client.clone(),
392346
namespace.clone(),
393-
self.k8s_dump_secret_values,
394347
)
395348
.dump()
396349
.await;
397350
K8sResourceDumper::<StatefulSet>::namespaced(
398351
self.context,
399352
self.client.clone(),
400353
namespace.clone(),
401-
self.k8s_dump_secret_values,
402354
)
403355
.dump()
404356
.await;
405357
K8sResourceDumper::<ReplicaSet>::namespaced(
406358
self.context,
407359
self.client.clone(),
408360
namespace.clone(),
409-
self.k8s_dump_secret_values,
410361
)
411362
.dump()
412363
.await;
413364
K8sResourceDumper::<NetworkPolicy>::namespaced(
414365
self.context,
415366
self.client.clone(),
416367
namespace.clone(),
417-
self.k8s_dump_secret_values,
418368
)
419369
.dump()
420370
.await;
421371
K8sResourceDumper::<Event>::namespaced(
422372
self.context,
423373
self.client.clone(),
424374
namespace.clone(),
425-
self.k8s_dump_secret_values,
426375
)
427376
.dump()
428377
.await;
429378
K8sResourceDumper::<Materialize>::namespaced(
430379
self.context,
431380
self.client.clone(),
432381
namespace.clone(),
433-
self.k8s_dump_secret_values,
434-
)
435-
.dump()
436-
.await;
437-
K8sResourceDumper::<Role>::namespaced(
438-
self.context,
439-
self.client.clone(),
440-
namespace.clone(),
441-
self.k8s_dump_secret_values,
442382
)
443383
.dump()
444384
.await;
385+
K8sResourceDumper::<Role>::namespaced(self.context, self.client.clone(), namespace.clone())
386+
.dump()
387+
.await;
445388
K8sResourceDumper::<RoleBinding>::namespaced(
446389
self.context,
447390
self.client.clone(),
448391
namespace.clone(),
449-
self.k8s_dump_secret_values,
450392
)
451393
.dump()
452394
.await;
453395
K8sResourceDumper::<ConfigMap>::namespaced(
454396
self.context,
455397
self.client.clone(),
456398
namespace.clone(),
457-
self.k8s_dump_secret_values,
458-
)
459-
.dump()
460-
.await;
461-
K8sResourceDumper::<Secret>::namespaced(
462-
self.context,
463-
self.client.clone(),
464-
namespace.clone(),
465-
self.k8s_dump_secret_values,
466399
)
467400
.dump()
468401
.await;
469402
K8sResourceDumper::<PersistentVolumeClaim>::namespaced(
470403
self.context,
471404
self.client.clone(),
472405
namespace.clone(),
473-
self.k8s_dump_secret_values,
474406
)
475407
.dump()
476408
.await;
477409
K8sResourceDumper::<ServiceAccount>::namespaced(
478410
self.context,
479411
self.client.clone(),
480412
namespace.clone(),
481-
self.k8s_dump_secret_values,
482413
)
483414
.dump()
484415
.await;
@@ -487,7 +418,6 @@ impl<'n> K8sDumper<'n> {
487418
self.context,
488419
self.client.clone(),
489420
namespace.clone(),
490-
self.k8s_dump_secret_values,
491421
)
492422
.dump()
493423
.await;
@@ -535,9 +465,6 @@ impl<'n> ContainerDumper for K8sDumper<'n> {
535465
futs.push(Box::pin(
536466
self.dump_kubectl_describe::<ConfigMap>(Some(namespace)),
537467
));
538-
futs.push(Box::pin(
539-
self.dump_kubectl_describe::<Secret>(Some(namespace)),
540-
));
541468
futs.push(Box::pin(
542469
self.dump_kubectl_describe::<PersistentVolumeClaim>(Some(namespace)),
543470
));

‎src/mz-debug/src/main.rs‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -70,9 +70,6 @@ pub struct SelfManagedDebugModeArgs {
7070
/// The kubernetes context to use.
7171
#[clap(long, env = "KUBERNETES_CONTEXT")]
7272
k8s_context: Option<String>,
73-
/// If true, the tool will dump the values of secrets in the Kubernetes cluster.
74-
#[clap(long, default_value = "false", action = clap::ArgAction::Set)]
75-
k8s_dump_secret_values: bool,
7673
}
7774

7875
#[derive(Parser, Debug, Clone)]
@@ -160,7 +157,6 @@ struct SelfManagedContext {
160157
k8s_namespace: String,
161158
mz_instance_name: String,
162159
k8s_additional_namespaces: Option<Vec<String>>,
163-
k8s_dump_secret_values: bool,
164160
mz_connection_info: SelfManagedMzConnectionInfo,
165161
http_connection_auth_mode: AuthMode,
166162
}
@@ -337,7 +333,6 @@ async fn initialize_context(
337333
k8s_namespace: args.k8s_namespace.clone(),
338334
mz_instance_name: args.mz_instance_name.clone(),
339335
k8s_additional_namespaces: args.additional_k8s_namespaces.clone(),
340-
k8s_dump_secret_values: args.k8s_dump_secret_values,
341336
mz_connection_info,
342337
http_connection_auth_mode: auth_mode,
343338
})
@@ -406,7 +401,6 @@ async fn run(context: Context) -> Result<(), anyhow::Error> {
406401
k8s_context,
407402
k8s_namespace,
408403
k8s_additional_namespaces,
409-
k8s_dump_secret_values,
410404
..
411405
}) => {
412406
if *dump_k8s {
@@ -416,7 +410,6 @@ async fn run(context: Context) -> Result<(), anyhow::Error> {
416410
k8s_namespace.clone(),
417411
k8s_additional_namespaces.clone(),
418412
k8s_context.clone(),
419-
*k8s_dump_secret_values,
420413
);
421414
dumper.dump_container_resources().await;
422415
}

0 commit comments

Comments
 (0)