Mask the Kubernetes Secrets data from dry-run and apply logs

[michalschott]

Different approach to fix #419

[stefanprodan]

@michalschott this is good start, can you please write some tests to ensure we don't replace all the lines in the error string? For a Kustomization that includes an invalid Secret, ConfigMap and Deployment only the Secret data should be replaced.

[michalschott]

Hey,

Just pushed an update / rebase. Now output looks like this:

{"level":"error","ts":"2021-09-03T12:32:09.349+0200","logger":"controller.kustomization","msg":"Reconciliation failed after 265.930013ms, next try in 15s","reconciler group":"kustomize.toolkit.fluxcd.io","reconciler kind":"Kustomization","name":"backend","namespace":"default","revision":"master/b241d5f983ace900e699cf32b398ebdf24d9a5d9","error":"apply failed: Error from server (BadRequest): error when creating \"934440a6-3b77-4597-bfdd-895d0629c44d.yaml\": Secret in version \"v1\" cannot be handled as a Secret: v1.Secret.Data:  [ ** REDACTED ** ]\n"}
{"level":"error","ts":"2021-09-03T12:32:55.272+0200","logger":"controller.kustomization","msg":"Reconciliation failed after 215.382556ms, next try in 15s","reconciler group":"kustomize.toolkit.fluxcd.io","reconciler kind":"Kustomization","name":"backend","namespace":"default","revision":"master/7cb4e2d4a9f361fd2db37e5e4805bbc192717348","error":"apply failed: Error from server (BadRequest): error when creating \"934440a6-3b77-4597-bfdd-895d0629c44d.yaml\": Secret in version \"v1\" cannot be handled as a Secret: v1.Secret.StringData:  [ ** REDACTED ** ]\n|..., bigger context ...|et-2\",\"namespace\":\"default\"},\"stringData\":{ [ ** REDACTED ** ] }\n|...\n"}

Having tests would be useful indeed, will see what can I do.

UPDATE:
Added unit test for stripSensitiveData function.

[stefanprodan]

@michalschott malformed secrets will not pass validation, can you please use stripSensitiveData for the validation error also?

[michalschott]

@michalschott malformed secrets will not pass validation, can you please use stripSensitiveData for the validation error also?

Good spot, actioned.

[stefanprodan]

LGTM

Thanks @michalschott 🏅

[hiddeco]

Not important for this PR, as we are foreseeing that it will be refactored soon (or handled differently), but in cases like this I would pick maskSensitiveData over the current function name.

As a strip would literally take all data out, instead of replacing (= masking) it.