Merge branch 'main' into feat/improve-subject-dn

Author: siegfriedweber

CHANGELOG.md

@@ -15,7 +15,12 @@ All notable changes to this project will be documented in this file.
 
 - Document Helm deployed RBAC permissions and remove unnecessary permissions ([#693]).
 
+### Fixed
+
+- Redact the user-provided PKCS#12 keystore password in operator logs. ([#706]).
+
 [#693]: https://github.com/stackabletech/secret-operator/pull/693
+[#706]: https://github.com/stackabletech/secret-operator/pull/706
 [#708]: https://github.com/stackabletech/secret-operator/pull/708
 
 ## [26.3.0] - 2026-03-16

Tiltfile

@@ -2,13 +2,19 @@
 meta = read_json('nix/meta.json')
 operator_name = meta['operator']['name']
 
-# If tilt_options.json exists read it and load the default_registry and default_repository value from it
+# If tilt_options.json exists read it and load the default_registry, default_operator_repository,
+# and default_product_repository value from it
 settings = read_json('tilt_options.json', default={})
 registry = settings.get('default_registry', 'oci.stackable.tech')
-repository = settings.get('default_repository', registry + '/' + 'sdp')
-operator_image_name = repository + '/' + operator_name
 
-# Configure default registry either read from config file above, or with default value of "oci.stackable.tech"
+# Construct the operator image repository. It uses the "sandbox" instead of the "sdp" namespace to
+# separate "testing/local" images from official (published) images.
+operator_repository = settings.get('default_operator_repository', registry + '/' + 'sandbox')
+operator_image_name = operator_repository + '/' + operator_name
+
+
+# Configure default registry either read from config file above, or with default value of
+# "oci.stackable.tech"
 default_registry(registry)
 
 custom_build(
@@ -31,14 +37,14 @@ k8s_kind('DaemonSet', image_json_path='{.spec.template.metadata.annotations.inte
 # supported by helm(set).
 helm_values = settings.get('helm_values', None)
 
-helm_override_image_repository = 'image.repository=' + repository
+helm_override_operator_image_repository = 'image.repository=' + operator_repository
 
 k8s_yaml(helm(
    'deploy/helm/' + operator_name,
    name=operator_name,
    namespace="stackable-operators",
    set=[
-      helm_override_image_repository,
+      helm_override_operator_image_repository,
    ],
    values=helm_values,
 ))

deploy/helm/secret-operator/templates/_helpers.tpl

@@ -79,7 +79,7 @@ helm.sh/test: {{ include "operator.chart" . }}
 {{- end }}
 
 {{/*
-Build the full container image reference.
+Build the full operator container image reference.
 */}}
 {{- define "operator.image" -}}
 {{- printf "%s/%s:%s" .Values.image.repository .Chart.Name (.Values.image.tag | default .Chart.AppVersion) -}}

docker/Dockerfile

@@ -37,7 +37,7 @@ ARG STACKABLE_USER_NAME="stackable"
 # "-c": Allows the execution of commands passed as a string
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
-# These labels have mostly been superceded by the OpenContainer spec annotations below but it doesn't hurt to include them
+# These labels have mostly been superseded by the OpenContainer spec annotations below but it doesn't hurt to include them
 # http://label-schema.org/rc1/
 LABEL name="Stackable Operator for Stackable Secret Operator"
 LABEL maintainer="info@stackable.tech"

nix/meta.json

@@ -22,7 +22,7 @@ pub fn convert(
         (WellKnownSecretData::TlsPem(pem), SecretFormat::TlsPkcs12) => {
             Ok(WellKnownSecretData::TlsPkcs12(convert_tls_to_pkcs12(
                 pem,
-                compat.tls_pkcs12_password.as_deref().unwrap_or_default(),
+                &compat.tls_pkcs12_password.unwrap_or_default(),
             )?))
         }
 

rust/operator-binary/src/format/convert.rs

@@ -4,7 +4,10 @@ use stackable_operator::schemars::{self, JsonSchema};
 use strum::EnumDiscriminants;
 
 use super::{ConvertError, SecretFiles, convert};
-use crate::{backend::ProvisionParts, utils::ResultExt};
+use crate::{
+    backend::ProvisionParts,
+    utils::{ResultExt, Unloggable},
+};
 
 const FILE_PEM_CERT_CERT: &str = "tls.crt";
 const FILE_PEM_CERT_KEY: &str = "tls.key";
@@ -168,7 +171,7 @@ pub struct CompatibilityOptions {
         rename = "secrets.stackable.tech/format.compatibility.tls-pkcs12.password",
         default
     )]
-    pub tls_pkcs12_password: Option<String>,
+    pub tls_pkcs12_password: Option<Unloggable<String>>,
 }
 
 /// Options to customize the well-known format file names.

rust/operator-binary/src/format/well_known.rs

@@ -181,6 +181,15 @@ pub fn asn1time_to_offsetdatetime(asn: &Asn1TimeRef) -> Result<OffsetDateTime, A
 // When/if migrating to Valuable, provide a dummy implementation of Value too
 pub struct Unloggable<T>(pub T);
 
+impl<T> Default for Unloggable<T>
+where
+    T: Default,
+{
+    fn default() -> Self {
+        Self(T::default())
+    }
+}
+
 impl<T> Debug for Unloggable<T> {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.write_str("<redacted>")
@@ -201,6 +210,12 @@ impl<T> DerefMut for Unloggable<T> {
     }
 }
 
+impl<'de, T: serde::Deserialize<'de>> serde::Deserialize<'de> for Unloggable<T> {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        T::deserialize(deserializer).map(Unloggable)
+    }
+}
+
 /// Wrapper type for [`Iterator::collect`] that flattens the incoming [`Iterator`].
 ///
 /// This isn't super useful for "regular" collects (just call [`Iterator::flatten`]!),

rust/operator-binary/src/utils.rs

@@ -1,5 +1,5 @@
 # This file includes unstable features, so you need to run "cargo +nightly fmt" to format your code.
-# It's also ok to use the stable toolchain by simple running "cargo fmt", but using the nigthly formatter is prefered.
+# It's also ok to use the stable toolchain by simple running "cargo fmt", but using the nightly formatter is preferred.
 
 # https://doc.rust-lang.org/nightly/edition-guide/rust-2024/rustfmt-style-edition.html
 style_edition = "2024"