feat(kuma-cp): remove value of secret when logging Secret Resources (#…

…5384)

* feat(kuma-cp): remove value of secret when logging Secret Resources

Signed-off-by: Marcin Skalski <marcin.skalski@konghq.com>
(cherry picked from commit cddddc9)
Signed-off-by: Marcin Skalski <marcin.skalski@konghq.com>

api/system/v1alpha1/datasource_helpers.go

@@ -0,0 +1,20 @@
+package v1alpha1
+
+import util_proto "github.com/kumahq/kuma/pkg/util/proto"
+
+func (ds *DataSource) MaskInlineDatasource() *DataSource {
+	if ds == nil {
+		return nil
+	}
+	if ds.GetInline().String() != "" {
+		return &DataSource{
+			Type: &DataSource_Inline{Inline: util_proto.Bytes([]byte("***"))},
+		}
+	}
+	if ds.GetInlineString() != "" {
+		return &DataSource{
+			Type: &DataSource_InlineString{InlineString: "***"},
+		}
+	}
+	return nil
+}

api/system/v1alpha1/secret_helper.go

@@ -0,0 +1,5 @@
+package v1alpha1
+
+func (s *Secret) MarshalLog() interface{} {
+	return "***"
+}

pkg/core/resources/apis/mesh/external_service_helpers.go

@@ -0,0 +1,44 @@
+package mesh
+
+import (
+	"google.golang.org/protobuf/proto"
+
+	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
+)
+
+func (es *ExternalServiceResource) IsReachableFromZone(zone string) bool {
+	return es.Spec.Tags[mesh_proto.ZoneTag] == "" || es.Spec.Tags[mesh_proto.ZoneTag] == zone
+}
+
+func (esl *ExternalServiceResourceList) MarshalLog() interface{} {
+	maskedList := make([]*ExternalServiceResource, 0, len(esl.Items))
+	for _, es := range esl.Items {
+		maskedList = append(maskedList, es.MarshalLog().(*ExternalServiceResource))
+	}
+	return ExternalServiceResourceList{
+		Items:      maskedList,
+		Pagination: esl.Pagination,
+	}
+}
+
+func (es *ExternalServiceResource) MarshalLog() interface{} {
+	spec := proto.Clone(es.Spec).(*mesh_proto.ExternalService)
+	if spec == nil {
+		return es
+	}
+	net := spec.GetNetworking()
+	if net == nil {
+		return es
+	}
+	tls := net.GetTls()
+	if tls == nil {
+		return es
+	}
+	tls.CaCert = tls.CaCert.MaskInlineDatasource()
+	tls.ClientCert = tls.ClientCert.MaskInlineDatasource()
+	tls.ClientKey = tls.ClientKey.MaskInlineDatasource()
+	return ExternalServiceResource{
+		Meta: es.Meta,
+		Spec: spec,
+	}
+}

pkg/core/resources/apis/mesh/mesh_helpers.go

@@ -7,7 +7,11 @@ import (
 	"strings"
 	"time"
 
+	"google.golang.org/protobuf/proto"
+
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
+	"github.com/kumahq/kuma/pkg/plugins/ca/provided/config"
+	util_proto "github.com/kumahq/kuma/pkg/util/proto"
 )
 
 func (m *MeshResource) HasPrometheusMetricsEnabled() bool {
@@ -124,3 +128,46 @@ func ParseDuration(durationStr string) (time.Duration, error) {
 	}
 	return dur, nil
 }
+
+func (ml *MeshResourceList) MarshalLog() interface{} {
+	maskedList := make([]*MeshResource, 0, len(ml.Items))
+	for _, mesh := range ml.Items {
+		maskedList = append(maskedList, mesh.MarshalLog().(*MeshResource))
+	}
+	return MeshResourceList{
+		Items:      maskedList,
+		Pagination: ml.Pagination,
+	}
+}
+
+func (m *MeshResource) MarshalLog() interface{} {
+	spec := proto.Clone(m.Spec).(*mesh_proto.Mesh)
+	if spec == nil {
+		return m
+	}
+	mtls := spec.Mtls
+	if mtls == nil {
+		return m
+	}
+	for _, backend := range mtls.Backends {
+		conf := backend.Conf
+		if conf == nil {
+			continue
+		}
+		cfg := &config.ProvidedCertificateAuthorityConfig{}
+		err := util_proto.ToTyped(conf, cfg)
+		if err != nil {
+			continue
+		}
+		cfg.Key = cfg.Key.MaskInlineDatasource()
+		cfg.Cert = cfg.Cert.MaskInlineDatasource()
+		backend.Conf, err = util_proto.ToStruct(cfg)
+		if err != nil {
+			continue
+		}
+	}
+	return MeshResource{
+		Meta: m.Meta,
+		Spec: spec,
+	}
+}

pkg/core/resources/apis/system/secret_resource_helper.go

@@ -0,0 +1,40 @@
+package system
+
+import (
+	"github.com/kumahq/kuma/pkg/core/resources/model"
+)
+
+type secretResource struct {
+	Meta model.ResourceMeta
+	Spec string
+}
+
+func (l *SecretResourceList) MarshalLog() interface{} {
+	list := make([]interface{}, 0, len(l.Items))
+	for _, res := range l.Items {
+		list = append(list, res.MarshalLog())
+	}
+	return list
+}
+
+func (sr *SecretResource) MarshalLog() interface{} {
+	return secretResource{
+		Meta: sr.Meta,
+		Spec: "***",
+	}
+}
+
+func (l *GlobalSecretResourceList) MarshalLog() interface{} {
+	list := make([]interface{}, 0, len(l.Items))
+	for _, res := range l.Items {
+		list = append(list, res.MarshalLog())
+	}
+	return list
+}
+
+func (gs *GlobalSecretResource) MarshalLog() interface{} {
+	return secretResource{
+		Meta: gs.Meta,
+		Spec: "***",
+	}
+}