Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1785201

Summary:	Don't gather pod endpoints using tokens
Product:	OpenShift Container Platform	Reporter:	Maciej Szulik <maszulik>
Component:	oc	Assignee:	Maciej Szulik <maszulik>
Status:	CLOSED ERRATA	QA Contact:	zhou ying <yinzhou>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	4.3.0	CC:	aos-bugs, jokerman, mfojtik, yinzhou
Target Milestone:	---
Target Release:	4.3.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1785194	Environment:
Last Closed:	2020-02-25 06:17:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1785194
Bug Blocks:

Description Maciej Szulik 2019-12-19 11:27:24 UTC

+++ This bug was initially created as a clone of Bug #1785194 +++

Currently oc adm inspect will send bearer tokens when scraping data from endpoints. This might expose the tokens to potentially untrustworthy parties.

Comment 2 zhou ying 2020-02-17 02:46:42 UTC

Confirmed with latest oc client , can't reproduce the issue now: 
[root@dhcp-140-138 ~]# oc version -o yaml 
clientVersion:
  buildDate: "2020-02-14T06:13:35Z"
  compiler: gc
  gitCommit: 1d7211968ceb449852d10d12eae92ed5c33d8b48
  gitTreeState: clean
  gitVersion: v4.3.3
  goVersion: go1.12.12
  major: ""
  minor: ""
  platform: linux/amd64


I0217 10:43:21.587619    5537 pod.go:71]         Skipping container endpoint collection for pod "kube-apiserver-ip-10-0-130-134.us-east-2.compute.internal" container "kube-apiserver": Using token authentication
I0217 10:43:21.587714    5537 pod.go:71]         Skipping container endpoint collection for pod "kube-apiserver-ip-10-0-130-134.us-east-2.compute.internal" container "kube-apiserver-cert-syncer": Using token authentication

Comment 4 errata-xmlrpc 2020-02-25 06:17:59 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0528