Ab#69525 #60

spbsoluble · 2025-10-09T17:50:31Z

1.2.2

Bug Fixes

fix(storetypes): K8SJKS and K8SPKCS12 storetypes using a separate k8s secret for store password does not crash
on missing or invalid secret field name.
fix(storetypes): K8SJKS where JKS files created using Keytool v20+ will be recognized as JKS files.
fix(storetypes): K8SJKS and K8SPKCS12 store/buddy passwords ending with a \n character will be trimmed to not include the newline.

Chores:

chore(docs): Update documentation format
chore(deps): Bump BouncyCastle.Cryptography to v2.6.2.

Release 1.2.1

…iles created with keytool `v20+` `AlgorithmIdentifier` change.

…K8SSecretException` if response is null or password field value is null or empty

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Pull Request Overview

Copilot reviewed 26 out of 50 changed files in this pull request and generated 15 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-17T16:30:26Z

kubernetes-orchestrator-extension/Jobs/JobBase.cs

+        Logger.LogTrace("K8S Store Password show new lines: {StorePassword}", storePassword.Replace("\n","\\n"));
+        // remove any trailing new line characters from the string
+        storePassword = storePassword.TrimEnd('\r','\n');
+        Logger.LogTrace("Store password bytes converted to string: {StorePassword}",
+            storePassword); //TODO: INSECURE COMMENT OUT


Secrets are being written to logs (both raw and with escaped newlines). Avoid logging passwords entirely. Remove these LogTrace calls or mask with fixed placeholder text.

Suggested change

Logger.LogTrace("K8S Store Password show new lines: {StorePassword}", storePassword.Replace("\n","\\n"));

// remove any trailing new line characters from the string

storePassword = storePassword.TrimEnd('\r','\n');

Logger.LogTrace("Store password bytes converted to string: {StorePassword}",

storePassword); //TODO: INSECURE COMMENT OUT

// Logger.LogTrace("K8S Store Password show new lines: {StorePassword}", storePassword.Replace("\n","\\n")); // Removed insecure logging

// remove any trailing new line characters from the string

storePassword = storePassword.TrimEnd('\r','\n');

// Logger.LogTrace("Store password bytes converted to string: {StorePassword}", storePassword); // Removed insecure logging

Copilot · 2025-10-17T16:30:26Z

kubernetes-orchestrator-extension/Clients/KubeClient.cs

                        var storePasswdString = Encoding.UTF8.GetString(storePasswordBytes);
+                        _logger.LogTrace("Importing existing PKCS12 data with store password: {StorePassword}",
+                            storePasswdString); //TODO: INSECURE COMMENT OUT


This logs the PKCS12 store password in clear text. Do not log secrets; remove the LogTrace or replace the value with a redacted placeholder.

Copilot · 2025-10-17T16:30:27Z

kubernetes-orchestrator-extension/StoreTypes/K8SJKS/Store.cs

+        using var outStream = new MemoryStream();
+        _logger.LogDebug("Saving JKS store to MemoryStream w/ password '{Pass}'",
+            storePassword ?? "null"); //TODO: INSECURE - Remove this line, it is for debugging purposes only


JKS store password is being logged. Remove secret logging; if needed, log only that a password was provided (e.g., ''). Similar secret-logging exists elsewhere in this file (e.g., lines 73-75, 81-82, 164-167, 332-335).

Copilot · 2025-10-17T16:30:27Z

kubernetes-orchestrator-extension/StoreTypes/K8SPKCS12/Store.cs

+
+        _logger.LogDebug("Adding store to list of serialized stores");
+        var filePath = Path.Combine(storePath, storeFileName);
+        _logger.LogDebug("Filepath '{Path}", filePath);


The structured logging template is malformed; the closing quote/brace is missing. It should be: _logger.LogDebug("Filepath '{Path}'", filePath);

Suggested change

_logger.LogDebug("Filepath '{Path}", filePath);

_logger.LogDebug("Filepath '{Path}'", filePath);

Copilot · 2025-10-17T16:30:27Z

kubernetes-orchestrator-extension/StoreTypes/K8SPKCS12/Store.cs

        _logger.MethodEntry(LogLevel.Debug);

-        _logger.LogDebug("Creating or updating PKCS12 store");
+        _logger.LogDebug("Creating or updating PKCS12 store for alias'{Alias}'", alias);


Minor formatting issue in the log message: add a space before the placeholder. For example: _logger.LogDebug("Creating or updating PKCS12 store for alias '{Alias}'", alias);

Suggested change

_logger.LogDebug("Creating or updating PKCS12 store for alias'{Alias}'", alias);

_logger.LogDebug("Creating or updating PKCS12 store for alias '{Alias}'", alias);

Copilot · 2025-10-17T16:30:29Z

docsource/k8stlssecr.md

+
+## Discovery Job Configuration
+
+For discovery of K8SNS stores toy can use the following params to filter the certificates that will be discovered:


Correct 'toy' to 'you'.

Suggested change

For discovery of K8SNS stores toy can use the following params to filter the certificates that will be discovered:

For discovery of K8SNS stores you can use the following params to filter the certificates that will be discovered:

Copilot · 2025-10-17T16:30:29Z

docsource/k8ssecret.md

+
+## Discovery Job Configuration
+
+For discovery of K8SNS stores toy can use the following params to filter the certificates that will be discovered:


Correct 'toy' to 'you'.

Suggested change

For discovery of K8SNS stores toy can use the following params to filter the certificates that will be discovered:

For discovery of K8SNS stores you can use the following params to filter the certificates that will be discovered:

Copilot · 2025-10-17T16:30:30Z

docsource/k8spkcs12.md

+
+## Discovery Job Configuration
+
+For discovery of `K8SPKCS12` stores toy can use the following params to filter the certificates that will be discovered:


Correct 'toy' to 'you'.

Suggested change

For discovery of `K8SPKCS12` stores toy can use the following params to filter the certificates that will be discovered:

For discovery of `K8SPKCS12` stores you can use the following params to filter the certificates that will be discovered:

Copilot · 2025-10-17T16:30:30Z

docsource/k8sns.md

+
+## Discovery Job Configuration
+
+For discovery of K8SNS stores toy can use the following params to filter the certificates that will be discovered:


Correct 'toy' to 'you'.

Suggested change

For discovery of K8SNS stores toy can use the following params to filter the certificates that will be discovered:

For discovery of K8SNS stores you can use the following params to filter the certificates that will be discovered:

Copilot · 2025-10-17T16:30:30Z

docsource/content.md

+
+## Discovery
+
+**NOTE:** To use discovery jobs, you must have the story type created in Keyfactor Command and the `needs_server` 


Correct 'story type' to 'store type'.

Suggested change

**NOTE:** To use discovery jobs, you must have the story type created in Keyfactor Command and the `needs_server`

**NOTE:** To use discovery jobs, you must have the store type created in Keyfactor Command and the `needs_server`

spbsoluble added 12 commits April 2, 2025 09:58

Merge pull request #57 from Keyfactor/release-1.2

d75e4dd

Release 1.2.1

chore(ci): Bump starter workflow to v4

7f87a02

chore(docs): Convert to doctool

eef6e25

fix(k8sjks): Bump BouncyCastle.Cryptography to 2.6.2 to fix JKS f…

0672028

…iles created with keytool `v20+` `AlgorithmIdentifier` change.

chore: cleanup

28291f1

chore(k8spkcs12): Add verbose logging and cleanup

6f56bef

chore: cleanup

923969f

chore: formatting + cleanup

57f2a18

chore(client): Add verbose logging, formatting + cleanup

f422ee8

fix(base): On store-types that support use buddypass throw `Invalid…

c07f6e0

…K8SSecretException` if response is null or password field value is null or empty

chore(tests): cleanup + formatting

7c067e0

chore(docs): update CHANGELOG.md

82c334e

spbsoluble requested a review from Copilot October 9, 2025 18:12

Copilot AI reviewed Oct 10, 2025

View reviewed changes

spbsoluble requested a review from Copilot October 17, 2025 16:25

Copilot AI reviewed Oct 17, 2025

View reviewed changes

	_logger.LogDebug("Filepath '{Path}", filePath);
	_logger.LogDebug("Filepath '{Path}'", filePath);

	_logger.LogDebug("Creating or updating PKCS12 store for alias'{Alias}'", alias);
	_logger.LogDebug("Creating or updating PKCS12 store for alias '{Alias}'", alias);


		## Discovery Job Configuration

		For discovery of K8SNS stores toy can use the following params to filter the certificates that will be discovered:

	For discovery of K8SNS stores toy can use the following params to filter the certificates that will be discovered:
	For discovery of K8SNS stores you can use the following params to filter the certificates that will be discovered:


		## Discovery Job Configuration

		For discovery of `K8SPKCS12` stores toy can use the following params to filter the certificates that will be discovered:

	For discovery of `K8SPKCS12` stores toy can use the following params to filter the certificates that will be discovered:
	For discovery of `K8SPKCS12` stores you can use the following params to filter the certificates that will be discovered:


		## Discovery

		NOTE: To use discovery jobs, you must have the story type created in Keyfactor Command and the `needs_server`

Uh oh!

Ab#69525 #60

Are you sure you want to change the base?

Ab#69525 #60

Uh oh!

Conversation

spbsoluble commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.2.2

Bug Fixes

Chores:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

spbsoluble commented Oct 9, 2025 •

edited

Loading