self-hosted/woodpecker
1
0
Fork 0
mirror of https://github.com/woodpecker-ci/woodpecker.git synced 2025-11-29 21:48:14 +02:00
Code Issues Releases Activity

kube backend: prevent secrets from leaking to Kubernetes apiserver logs (#5196)

Browse Source
This commit is contained in:
Harri Avellan
2025-06-14 23:44:33 +03:00
committed by GitHub
parent d5537e6fa5
commit 5e052f5579
9 changed files with 297 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pipeline/frontend/yaml/compiler/settings/params.go
View File

@@ -24,9 +24,17 @@ import (
"gopkg.in/yaml.v3"
)
func captureInjectedSecret(k string, secretMapping map[string]string, getSecretValue func(name string) (string, error)) func(name string) (string, error) {
return func(name string) (string, error) {
v, err := getSecretValue(name)
secretMapping[k] = v
return v, err
}
}
// ParamsToEnv uses reflection to convert a map[string]interface to a list
// of environment variables.
func ParamsToEnv(from map[string]any, to map[string]string, prefix string, upper bool, getSecretValue func(name string) (string, error)) (err error) {
func ParamsToEnv(from map[string]any, to map[string]string, prefix string, upper bool, getSecretValue func(name string) (string, error), secretMapping map[string]string) (err error) {
if to == nil {
return fmt.Errorf("no map to write to")
}
@@ -34,7 +42,7 @@ func ParamsToEnv(from map[string]any, to map[string]string, prefix string, upper
if v == nil || len(k) == 0 {
continue
}
to[sanitizeParamKey(prefix, upper, k)], err = sanitizeParamValue(v, getSecretValue)
to[sanitizeParamKey(prefix, upper, k)], err = sanitizeParamValue(v, captureInjectedSecret(sanitizeParamKey(prefix, upper, k), secretMapping, getSecretValue))
if err != nil {
return err
}