Trim or redact apply-setters results#1266
Conversation
Signed-off-by: Mózes László Máté <laszlo.mozes@nokia.com>
Signed-off-by: Mózes László Máté <laszlo.mozes@nokia.com>
Signed-off-by: Mózes László Máté <laszlo.mozes@nokia.com>
Assisted-by: Cursor:composer-2.5 Signed-off-by: Mózes László Máté <laszlo.mozes@nokia.com>
✅ Deploy Preview for krm-function-catalog canceled.
|
There was a problem hiding this comment.
Pull request overview
This PR updates the apply-setters Go function to reduce the risk of leaking sensitive data and to keep function results/log output smaller by redacting likely-secret values (based on field path, setter names, and value patterns) and truncating long values. It also refactors result construction to use the new github.com/kptdev/kpt/api/fnresult/v1 ResultItem model and restructures visitor/walk logic into clearer files.
Changes:
- Redact likely-secret values and truncate long values before emitting
ResultItemmessages/fields. - Refactor apply-setters results to produce richer
framework.Resultoutput (message/severity/file/resourceRef/field current+proposed values). - Restructure visitor/walker code and update dependencies to include
github.com/kptdev/kpt/api.
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| functions/go/apply-setters/main.go | Maps internal ResultItems to framework.Result output fields (message/severity/file/resourceRef/field values). |
| functions/go/apply-setters/go.mod | Adds dependency on github.com/kptdev/kpt/api and updates indirect requirements. |
| functions/go/apply-setters/go.sum | Updates module checksums consistent with dependency changes. |
| functions/go/apply-setters/applysetters/apply_setters.go | Switches results to fnresult.ResultItem and captures ResourceIdentifier metadata for results. |
| functions/go/apply-setters/applysetters/walk.go | Keeps traversal logic; now relies on visitor definitions moved into visit.go. |
| functions/go/apply-setters/applysetters/visit.go | Adds visitor implementation plus buildResultItem to sanitize/redact/truncate output. |
| functions/go/apply-setters/applysetters/trim.go | Implements redaction heuristics and truncation for safe result logging. |
| functions/go/apply-setters/applysetters/trim_test.go | Adds focused unit tests for redaction/truncation behavior. |
| functions/go/apply-setters/applysetters/apply_setters_test.go | Extends tests to assert redaction behavior in emitted results. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: Mózes László Máté <laszlo.mozes@nokia.com>
|
We could consider using some third party lib for matching patterns, it looks like the coverage with these patterns is a bit lackluster... |
Signed-off-by: Mózes László Máté <laszlo.mozes@nokia.com>
The apply-setters function currently writes whatever it has set to the log. This can expose sensitive data and generally bloat logs for large values.
In this PR, we redact well-known patterns based on both the value and the field path, as well as truncate long values.
Also did quite a bit of restructuring and refactoring to use the new kpt api module.
The large line diff is because of the restructuring of the files. The new logic starts from commit 016d182 .
AI was used in the creation of this PR: