Redact plaintext MySQL password from superset entrypoint logs (#168)

* Redact plaintext MySQL password from superset entrypoint logs

entrypoint.sh's set -euxo pipefail traced the fully-substituted
superset test_db command, including the plaintext mysql_superset_password
secret, to stderr. Separately, superset test_db itself prints the full
SQLAlchemy connection URI (with password) to stdout. Both ended up in
docker logs / docker service logs superset, and persisted indefinitely
in the host's json-file log driver.

Build the DB URI in a variable with -x off, and pipe test_db's combined
output through a literal-string redaction filter before it reaches
Docker's log driver. -x tracing resumes for the rest of the script.

* Move password-redaction filter to a standalone script

Inline python3 -c couldn't be indented to match entrypoint.sh's style
without breaking Python's indentation-sensitive syntax. Move it to
redact_secret.py (picked up by the existing COPY . /app/ in the
Dockerfile) so both files keep normal, consistent indentation.

Author: szachovy

CHANGELOG.md

@@ -39,6 +39,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* Redacted MySQL password from `superset` entrypoint's `test_db` output and disabled `-x` tracing around it,
+  preventing plaintext password exposure in `docker logs`/`docker service logs`.
 * Upload `.py` source instead of `.pyc` bytecode to decouple host Python version. (#38, #41)
 * Fixed `run_mysql_server()` not instantiating `MySQLServer` class. (#94)
 * Disabled MD060 markdownlint rule to fix table column style false positives in documentation. (#94)

services/superset/entrypoint.sh

@@ -1,11 +1,14 @@
 #!/bin/bash
 
-set -euxo pipefail
+set -euo pipefail
+
+DB_PASSWORD=$(< /run/secrets/mysql_superset_password)
+DB_URI="mysql+mysqlconnector://superset:${DB_PASSWORD}@${VIRTUAL_IP_ADDRESS}:6446/superset"
+
+if superset test_db "$DB_URI" --connect-args {} 2>&1 \
+    | DB_PASSWORD="$DB_PASSWORD" python3 /app/redact_secret.py; then
+  set -x
 
-if superset test_db \
-    "mysql+mysqlconnector://superset:$(< /run/secrets/mysql_superset_password)@${VIRTUAL_IP_ADDRESS}:6446/superset" \
-    --connect-args {}; then
-  
   superset fab create-admin \
   --username "superset" \
   --firstname "superset" \

services/superset/redact_secret.py

@@ -0,0 +1,8 @@
+#!/usr/bin/env python3
+import os
+import sys
+
+pw = os.environ["DB_PASSWORD"]
+for line in sys.stdin:
+    sys.stdout.write(line.replace(pw, "<redacted>"))
+    sys.stdout.flush()