Redact plaintext MySQL password from superset entrypoint logs - #168
Merged
Conversation
entrypoint.sh's set -euxo pipefail traced the fully-substituted superset test_db command, including the plaintext mysql_superset_password secret, to stderr. Separately, superset test_db itself prints the full SQLAlchemy connection URI (with password) to stdout. Both ended up in docker logs / docker service logs superset, and persisted indefinitely in the host's json-file log driver. Build the DB URI in a variable with -x off, and pipe test_db's combined output through a literal-string redaction filter before it reaches Docker's log driver. -x tracing resumes for the rest of the script.
Inline python3 -c couldn't be indented to match entrypoint.sh's style without breaking Python's indentation-sensitive syntax. Move it to redact_secret.py (picked up by the existing COPY . /app/ in the Dockerfile) so both files keep normal, consistent indentation.
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
entrypoint.shran underset -euxo pipefail, so the-xtrace printed the fully-substitutedsuperset test_db mysql+mysqlconnector://superset:<password>@...command to stderr on every start.superset test_dbitself prints the full SQLAlchemy connection URI (password included) to stdout as part of its "Collecting additional connection information..." output.docker logs superset/docker service logs superset(no node access needed) and persisted indefinitely in the host's default json-file log driver (no rotation configured).Fix
-xoff, so bash's own trace never echoes the password.-xresumes right after the connectivity check for the rest of the script (create-admin, db upgrade, celery, etc. — unaffected).test_db's combined stdout/stderr through a small inlinepython3filter that does a literal string-replace of the password with<redacted>, as a backstop for Superset's own URI printout, which can't be silenced via bash flags since it's the CLI's own behavior.pipefail(already set) still correctly propagatestest_db's real exit code through the pipe, so theif/elseconnectivity check is unaffected.CHANGELOG.mdentry under### Fixed.Test plan
bash -n services/superset/entrypoint.sh— syntax OK-xtrace line, and Superset's "SQLAlchemy URI: ..." printout) through the redaction filter locally — both resolve to<redacted>docker service logs superset | grep -c '<password>'check from the original test writeup against a live cluster (no docker/cluster access in the environment this was developed in)