Repository navigation
Sanitize credentials from snapshot repository URLs (upstream #1174) - #2
Open
Svilen-Stefanov wants to merge 1 commit into
Open
Svilen-Stefanov wants to merge 1 commit into
Svilen-Stefanov wants to merge 1 commit into
Conversation
REST backend repository URLs can contain credentials in the userinfo component (e.g. rest:https://user:pass@host/path). These were stored verbatim in Snapshot CRs and visible via kubectl get snapshot, exposing credentials to anyone with read access to the namespace. Add sanitizeRepositoryURL() that replaces userinfo with "redacted" before storing in the Snapshot spec. This only affects REST backends — S3/Azure/Swift/B2/GCS backends don't include credentials in the repository URL. Fixes k8up-io#1077 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Aarno Aukia <aarno.aukia@vshn.ch>
CodeBoarding reviewStatus: 2 changed components See the full change in CodeBoarding. graph LR
n_Operator_Controllers["Operator Controllers"]
n_Restic_Execution_Client["Restic Execution Client"]
n_Kubernetes_API_Schemas["Kubernetes API Schemas"]
n_Command_Line_Entrypoints["Command-Line Entrypoints"]
n_Restore_Utilities_and_Helpers["Restore Utilities and Helpers"]
n_Operator_Controllers -- "discovers target pods via" --> n_Restic_Execution_Client
n_Operator_Controllers -- "reconciles and mutates" --> n_Kubernetes_API_Schemas
n_Restic_Execution_Client -- "utilizes string generator from" --> n_Operator_Controllers
n_Restic_Execution_Client -- "streams archives through" --> n_Restore_Utilities_and_Helpers
n_Command_Line_Entrypoints -- "registers controllers in" --> n_Operator_Controllers
n_Command_Line_Entrypoints -- "invokes restic commands on" --> n_Restic_Execution_Client
n_Command_Line_Entrypoints -- "invokes restore helpers from" --> n_Restore_Utilities_and_Helpers
classDef added fill:#1f883d,stroke:#0b5d23,color:#ffffff;
classDef modified fill:#bf8700,stroke:#7d4e00,color:#ffffff;
classDef deleted fill:#cf222e,stroke:#82071e,color:#ffffff,stroke-dasharray:5 3;
class n_Restic_Execution_Client modified;
|
Author
|
/codeboarding |
CodeBoarding reviewStatus: 2 changed components See the full change in CodeBoarding. graph LR
n_Operator_Controllers["Operator Controllers"]
n_Restic_Execution_Client["Restic Execution Client"]
n_Kubernetes_API_Schemas["Kubernetes API Schemas"]
n_Command_Line_Entrypoints["Command-Line Entrypoints"]
n_Restore_Utilities_and_Helpers["Restore Utilities and Helpers"]
n_Operator_Controllers -- "discovers target pods via" --> n_Restic_Execution_Client
n_Operator_Controllers -- "reconciles and mutates" --> n_Kubernetes_API_Schemas
n_Restic_Execution_Client -- "utilizes string generator from" --> n_Operator_Controllers
n_Restic_Execution_Client -- "streams archives through" --> n_Restore_Utilities_and_Helpers
n_Command_Line_Entrypoints -- "registers controllers in" --> n_Operator_Controllers
n_Command_Line_Entrypoints -- "invokes restic commands on" --> n_Restic_Execution_Client
n_Command_Line_Entrypoints -- "invokes restore helpers from" --> n_Restore_Utilities_and_Helpers
classDef added fill:#1f883d,stroke:#0b5d23,color:#ffffff;
classDef modified fill:#bf8700,stroke:#7d4e00,color:#ffffff;
classDef deleted fill:#cf222e,stroke:#82071e,color:#ffffff,stroke-dasharray:5 3;
class n_Restic_Execution_Client modified;
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reproduction of upstream k8up-io#1174 for a CodeBoarding architecture-review demo.