Restrict test log outputs - #1450
Conversation
This to avoid printing secrets into logs, as another layer of security, even though the CI environments are isolated and short-lived. The change does the following: * Default `use_no_log: true`. * Add `use_no_log` onto more tasks. * Disable xtrace (`set -x`) on such tasks as another precaution. This is done via a new `shell_header_no_xtrace` variable so that the behavior is not hardcoded. If debugging of the relevant tasks is necessary, it can be done by tweaking these variables for a testproject. Assisted by: goose+gemini
cjeanner
left a comment
cjeanner
left a comment
There was a problem hiding this comment.
Sounds a reasonable way to avoid leaking data. I love the way you allow to override the "set -x" set in the default shell_header. Maybe this needs to be properly documented though in the adoption documentation?
|
Thanks for the reviews, i'll add the needed labels. |
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Re documentation, that automation and the variable is CI/tests only, we don't have |
794064a
into
openstack-k8s-operators:main
|
/cherry-pick 18.0-fr6 |
|
@jistr: new pull request created: #1457 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/cherry-pick 18-stable |
|
@jistr: new pull request created: #1462 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
4 participants
This to avoid printing secrets into logs, as another layer of security, even though the CI environments are isolated and short-lived.
The change does the following:
Default
use_no_log: true.Add
use_no_logonto more tasks.Disable xtrace (
set -x) on such tasks as another precaution. This is done via a newshell_header_no_xtracevariable so that the behavior is not hardcoded.If debugging of the relevant tasks is necessary, it can be done by tweaking these variables for a testproject.
Assisted by: goose+gemini