Bug 2274193 - cleartext postgres password in noobaa-db-pg init container logs
Summary: cleartext postgres password in noobaa-db-pg init container logs
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenShift Data Foundation
Classification: Red Hat Storage
Component: Multi-Cloud Object Gateway
Version: 4.14
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: ODF 4.16.0
Assignee: Nimrod Becker
QA Contact: Tiffany Nguyen
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-04-09 16:17 UTC by Dmitry Mishin
Modified: 2024-07-17 13:18 UTC (History)
3 users (show)

Fixed In Version: 4.16.0-73
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2024-07-17 13:18:43 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github noobaa noobaa-operator pull 1317 0 None Merged removed init container for Postgres DB pod 2024-04-10 07:34:21 UTC
Github red-hat-storage ocs-ci pull 9806 0 None Merged GSS bz-2274193 noobaa db cleartext postgres password 2024-05-20 14:19:33 UTC
Red Hat Product Errata RHSA-2024:4591 0 None None None 2024-07-17 13:18:46 UTC

Description Dmitry Mishin 2024-04-09 16:17:11 UTC
Description of problem (please be detailed as possible and provide log
snippests):

init container for noobaa postgres db has "sh -x"

oc get sts noobaa-db-pg -o yaml | grep -A 4 command:
      - command:
        - sh
        - -x
        - /init/initdb.sh
        env:


As result in init container log we see

oc logs noobaa-db-pg-0 --tail=-1 -c initialize-database | grep set=password
++ _psql --set=username=noobaa --set=password=CpYG7qwjZvrHhA==
++ psql --set ON_ERROR_STOP=1 --set=username=noobaa --set=password=CpYG7qwjZvrHhA==


Version of all relevant components (if applicable):
stable-4.14

Does this issue impact your ability to continue to work with the product
(please explain in detail what is the user impact)?


Is there any workaround available to the best of your knowledge?


Rate from 1 - 5 the complexity of the scenario you performed that caused this
bug (1 - very simple, 5 - very complex)?
1

Can this issue reproducible?
yes

Can this issue reproduce from the UI?


If this is a regression, please provide more details to justify this:


Steps to Reproduce:
1. create a noobaa CR
2. check the postgres sts logs
3.


Actual results:


Expected results:


Additional info:

Comment 6 Tiffany Nguyen 2024-04-17 01:02:25 UTC
Verified using ODF 4.16.0-76.  There is no postgres password display in noobaa-db-pg logs.

Comment 7 Tiffany Nguyen 2024-04-17 01:05:28 UTC
Confirmed that init container for Postgres DB pod was removed.

Comment 9 errata-xmlrpc 2024-07-17 13:18:43 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Red Hat OpenShift Data Foundation 4.16.0 security, enhancement & bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2024:4591


Note You need to log in before you can comment on or make changes to this bug.