Skip to content

Mask sensitive log data

Marin Milina edited this page May 8, 2023 · 3 revisions

SDK enables masking sensitive data in logs.

All task input properties with password: true values are masked in logs, replacing them with ********.

Masking is implemented using LogFilter from k8s.io/klog/v2.

Filtering is done for formatted and structured log outputs.

Examples:

  • klog.Infof("my password is %s", passwordProperty.Value) -> output is my password is ********
  • klog.InfoS("my password is ", "password", passwordProperty.Value)) -> output is "my password is " value="********"

With plain log (without formatting and structuring) secrets will not be masked. Example:

  • klog.Info("my password is %s", passwordProperty.Value) -> output is my password is P@$$w0rd

Logger can be tested from everywhere where release-integration-sdk-go module is imported.

It is necessary to import "k8s.io/klog/v2" (be careful and don't import "k8s.io/klog")

Clone this wiki locally