license: unredact logs written by license enforcer

This makes it so log messages are not redacted unnecessarily.

- Use redact.StringBuilder instead of strings.Builder.
- Avoid using `.String()` arguments for log.Infof, since strings are
  always redacted.
- Mark license type as a redact.SafeValue.

Release note: None

pkg/server/license/BUILD.bazel

@@ -24,6 +24,7 @@ go_library(
         "//pkg/util/syncutil",
         "//pkg/util/timeutil",
         "@com_github_cockroachdb_errors//:errors",
+        "@com_github_cockroachdb_redact//:redact",
     ],
 )
 

pkg/server/license/cclbridge.go

@@ -9,6 +9,7 @@ import (
 	"context"
 
 	"github.com/cockroachdb/cockroach/pkg/settings/cluster"
+	"github.com/cockroachdb/redact"
 )
 
 // This file serves as a bridge to the license code in the CCL packages.
@@ -24,6 +25,11 @@ var RegisterCallbackOnLicenseChange = func(context.Context, *cluster.Settings, *
 // enforcer.
 type LicType int
 
+var _ redact.SafeValue = LicType(0)
+
+// SafeValue implements the redact.SafeValue interface.
+func (i LicType) SafeValue() {}
+
 //go:generate stringer -type=LicType -linecomment
 const (
 	LicTypeNone       LicType = iota // none

pkg/server/license/enforcer.go

@@ -7,8 +7,6 @@ package license
 
 import (
 	"context"
-	"fmt"
-	"strings"
 	"sync/atomic"
 	"time"
 
@@ -24,6 +22,7 @@ import (
 	"github.com/cockroachdb/cockroach/pkg/util/syncutil"
 	"github.com/cockroachdb/cockroach/pkg/util/timeutil"
 	"github.com/cockroachdb/errors"
+	"github.com/cockroachdb/redact"
 )
 
 const (
@@ -229,15 +228,15 @@ func (e *Enforcer) initClusterMetadata(ctx context.Context, options options) err
 		end := (*e.metadataAccessor.Load()).GetClusterInitGracePeriodTS()
 		if end != 0 {
 			e.clusterInitGracePeriodEndTS.Store(end)
-			log.Infof(ctx, "fetched cluster init grace period end time from system tenant: %s", e.GetClusterInitGracePeriodEndTS().String())
+			log.Infof(ctx, "fetched cluster init grace period end time from system tenant: %s", e.GetClusterInitGracePeriodEndTS())
 		} else {
 			// No timestamp was received, likely due to a mixed-version workload.
 			// We'll use an estimate of 7 days from this node's startup time instead
 			// and set a flag to continue polling for an updated timestamp.
 			// An update should be sent once the KV starts up on the new version.
 			gracePeriodLength := e.getGracePeriodDuration(7 * 24 * time.Hour)
 			e.clusterInitGracePeriodEndTS.Store(e.getStartTime().Add(gracePeriodLength).Unix())
-			log.Infof(ctx, "estimated cluster init grace period end time as: %s", e.GetClusterInitGracePeriodEndTS().String())
+			log.Infof(ctx, "estimated cluster init grace period end time as: %s", e.GetClusterInitGracePeriodEndTS())
 			e.continueToPollMetadataAccessor.Store(true)
 		}
 		return nil
@@ -289,12 +288,12 @@ func (e *Enforcer) initClusterMetadata(ctx context.Context, options options) err
 			}
 			gracePeriodLength = e.getGracePeriodDuration(gracePeriodLength) // Allow the value to be shortened by env var
 			end := e.getStartTime().Add(gracePeriodLength)
-			log.Infof(ctx, "generated new cluster init grace period end time: %s", end.UTC().String())
+			log.Infof(ctx, "generated new cluster init grace period end time: %s", end.UTC())
 			e.clusterInitGracePeriodEndTS.Store(end.Unix())
 			return txn.KV().Put(ctx, keys.ClusterInitGracePeriodTimestamp, e.clusterInitGracePeriodEndTS.Load())
 		}
 		e.clusterInitGracePeriodEndTS.Store(val.ValueInt())
-		log.Infof(ctx, "fetched existing cluster init grace period end time: %s", e.GetClusterInitGracePeriodEndTS().String())
+		log.Infof(ctx, "fetched existing cluster init grace period end time: %s", e.GetClusterInitGracePeriodEndTS())
 		return nil
 	})
 }
@@ -473,18 +472,18 @@ func (e *Enforcer) RefreshForLicenseChange(
 		e.licenseRequiresTelemetry.Store(false)
 	}
 
-	var sb strings.Builder
-	sb.WriteString(fmt.Sprintf("enforcer license updated: type is %s, ", licType.String()))
+	var sb redact.StringBuilder
+	sb.Printf("enforcer license updated: type is %s, ", licType)
 	gpEnd, _ := e.GetGracePeriodEndTS()
 	if !gpEnd.IsZero() {
-		sb.WriteString(fmt.Sprintf("grace period ends at %q, ", gpEnd))
+		sb.Printf("grace period ends at %q, ", gpEnd)
 	}
 	expiry := timeutil.Unix(e.licenseExpiryTS.Load(), 0)
 	if !expiry.IsZero() {
-		sb.WriteString(fmt.Sprintf("expiration at %q, ", expiry))
+		sb.Printf("expiration at %q, ", expiry)
 	}
-	sb.WriteString(fmt.Sprintf("telemetry required: %t", e.licenseRequiresTelemetry.Load()))
-	log.Infof(ctx, "%s", sb.String())
+	sb.Printf("telemetry required: %t", e.licenseRequiresTelemetry.Load())
+	log.Infof(ctx, "%s", sb.RedactableString())
 }
 
 // UpdateTrialLicenseExpiry returns the expiration timestamp of any trial license
@@ -702,7 +701,7 @@ func (e *Enforcer) pollMetadataAccessor(ctx context.Context) {
 			e.storeNewGracePeriodEndDate(e.GetClusterInitGracePeriodEndTS(), 0)
 			e.continueToPollMetadataAccessor.Store(false)
 			log.Infof(ctx, "late retrieval of cluster initialization grace period end time from system tenant: %s",
-				e.GetClusterInitGracePeriodEndTS().String())
+				e.GetClusterInitGracePeriodEndTS())
 		}
 	}
 }

pkg/testutils/lint/passes/redactcheck/redactcheck.go

@@ -154,6 +154,9 @@ func runAnalyzer(pass *analysis.Pass) (interface{}, error) {
 					"github.com/cockroachdb/cockroach/pkg/rpc/rpcpb": {
 						"ConnectionClass": {},
 					},
+					"github.com/cockroachdb/cockroach/pkg/server/license": {
+						"LicType": {},
+					},
 					"github.com/cockroachdb/cockroach/pkg/sql/catalog/catpb": {
 						"JobID":      {},
 						"ScheduleID": {},