Strips newlines from AWS host/username secrets#842
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (9)
📝 WalkthroughSummary by CodeRabbit
WalkthroughTekton host-info secret generation now strips newline and carriage-return characters before base64 encoding selected fields across rendered and template YAML files. A new Go test scans infra task YAML files and checks that the expected sanitization rules are applied per field. ChangesHost-info secret encoding
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Warning Tools execution failed with the following error: Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This test ensures `tr -d '\n\r'` is correctly applied to host and username fields, but *not* to `id_rsa`, within AWS host-access secret templates. This prevents malformed private keys while ensuring host/username values are single-line.
|
thx @abdulazeem-tk4vr for the contribution, can you check the failure it needs to catch the error I think, also can you extend the fix to all tekton tasks not only aws? |
|
@abdulazeem-tk4vr any chance you can take a look? |
sorry about the delay, I had lost access to some of my personal devices. I will quickly address this |
Extend the newline stripping (`tr -d '\n\r'`) to `host`, `username`, and `adminusername` fields within Azure infrastructure task secrets. This ensures these string values are consistently single-line when base64-encoded, preventing potential parsing or usage issues in downstream systems. The related test (`host_access_secret_test`) is generalized to validate this behavior for both AWS and Azure tasks. It now explicitly requires newline stripping for appropriate string fields while ensuring sensitive keys/passwords (e.g., `id_rsa`, `userpassword`) remain untouched to prevent corruption.
|
@adrianriobo all the checks have passed! Hopefully this is sufficient, if there are any further testing steps please let me know! |
2 participants
Ensures that
hostandusernamevalues extracted from files for AWS host-access secrets are properly sanitized.Previously, these values could include newline or carriage return characters, leading to incorrect base64 encoding and potential issues when creating Kubernetes Opaque secrets. Adding
tr -d '\n\r'removes these characters, ensuring the secret data is clean and valid.This PR helps close the issue in redhat-developer/mapt - #817