Bug 2058542 - Cloud credentials in Logs
Summary: Cloud credentials in Logs
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat OpenShift Data Foundation
Classification: Red Hat Storage
Component: odf-dr
Version: 4.10
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
: ODF 4.10.0
Assignee: gowtham
QA Contact: Shrivaibavi Raghaventhiran
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-02-25 10:09 UTC by gowtham
Modified: 2023-08-09 17:00 UTC (History)
8 users (show)

Fixed In Version: 4.10.0-175
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-04-21 09:12:49 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github red-hat-storage odf-multicluster-orchestrator pull 80 0 None open [release-4.10] Ignore logging credentials 2022-03-01 05:59:23 UTC

Description gowtham 2022-02-25 10:09:21 UTC
Description of problem (please be detailed as possible and provide log
snippets):

ODF-MCO operator logging security credentials.

2022-02-24T10:38:51.867Z	INFO	controller-runtime.manager.controller.secret	Creating a s3 secret	{"reconciler group": "", "reconciler kind": "Secret", "name": "756bd87b55371f0a9a791269d78efdaeb2617fc", "namespace": "spoke-cluster", "secret": {"metadata":{"name":"756bd87b55371f0a9a791269d78efdaeb2617fc","namespace":"openshift-dr-system","creationTimestamp":null,"labels":{"multicluster.odf.openshift.io/created-by":"mirrorpeersecret"}},"data":{"AWS_ACCESS_KEY_ID":"**************************,"AWS_SECRET_ACCESS_KEY":"*******************"},"type":"Opaque"}}



Version of all relevant components (if applicable):


Does this issue impact your ability to continue to work with the product
(please explain in detail what is the user impact)?


Is there any workaround available to the best of your knowledge?


Rate from 1 - 5 the complexity of the scenario you performed that caused this
bug (1 - very simple, 5 - very complex)?


Can this issue reproducible?


Can this issue reproduce from the UI?


If this is a regression, please provide more details to justify this:


Steps to Reproduce:
1. Import 2 managed clusters in ACM.
2. Install ODFMCO on the Hub cluster.
3. Install ODF operator on each managed cluster.
4. Create OCS StorageSystem on each managed cluster.
5. Do not install the ODR HUB operator(Ramen hub operator) on the hub cluster.
6. Make sure "openshift-dr-system" is not present.
6. Create MirrorPeer CR with "manageS3" flag enabled.
7. Check ODFMCO operator logs on the openshift-operators namespace. It will log AWS credentials.
 


Actual results:
the cloud API credentials are logged when creating/updating the s3 secret.

Expected results:
Logs should not have any credentials information.

Additional info:

Comment 6 Shrivaibavi Raghaventhiran 2022-03-22 14:21:13 UTC
Tested version:
----------------
OCP - 4.10.0-0.nightly-2022-03-19-230512
ODF - quay.io/rhceph-dev/ocs-registry:4.10.0-201
ACM - 2.4.2

Steps followed:
---------------
Steps to reproduce as mentioned above

Observations:
--------------

Did not see any AWS cloud credentials in the odfmo-controller-manager pod. Hence moving the BZ to verified state.

Attaching the logs of odfmo-controller-manager pod for reference.


Note You need to log in before you can comment on or make changes to this bug.