Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Document configopaque security expectations #9274

Closed
Tracked by #9167
mx-psi opened this issue Jan 12, 2024 · 3 comments · Fixed by #9295
Closed
Tracked by #9167

Document configopaque security expectations #9274

mx-psi opened this issue Jan 12, 2024 · 3 comments · Fixed by #9295
Labels
area:config
Milestone
go.opentelemetry....

Comments

@mx-psi
Copy link
Member

mx-psi commented Jan 12, 2024 •
edited
Loading

The aim of the configopaque package is to have opaque types to prevent leakage of secrets in configuration. We should document under what situations do we aim to redact output, since it's kind of fuzzy right now (it used to be just for marshaling, now we also redact logs).

It may also be that we miss some cases, would we be justified in making breaking changes if something like this happens again?
@mx-psi mx-psi mentioned this issue Jan 12, 2024
Closed
10 tasks
@TylerHelmuth
Copy link
Member

TylerHelmuth commented Jan 12, 2024 •
edited
Loading

Would a over-arching statement like:

The only way to view the value stored in configopaque.String is to first convert it to a string.

be enough?

@TylerHelmuth TylerHelmuth mentioned this issue Jan 12, 2024
Closed
@mx-psi
Copy link
Member Author

mx-psi commented Jan 15, 2024

@TylerHelmuth That makes sense to me. My main goal with this is that we have a guide if we have to make changes after 1.0 (e.g. what is bug, what should be kept as is)

@mx-psi mx-psi mentioned this issue Jan 16, 2024
Merged
@mx-psi
Copy link
Member Author

mx-psi commented Jan 16, 2024

Filed #9295 adding the statement by @TylerHelmuth as well as some more information

codeboten pushed a commit that referenced this issue Jan 16, 2024
@mx-psi
[chore] Clarify configopaque expectations (#9295)
3a16592 
Documents `configopaque` expectations.

The intention is that it is clear that we can add interface
implementations after 1.0 if not doing so would leak opaque values.

Fixes #9274
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area:config
Projects
None yet
Milestone
go.opentelemetry.io/collector/config/...
Development

Successfully merging a pull request may close this issue.

[chore] Clarify configopaque expectations mx-psi/opentelemetry-collector
2 participants
@mx-psi @TylerHelmuth