potiuk commented on code in PR #70956:
URL: https://github.com/apache/airflow/pull/70956#discussion_r3775619888
##########
airflow-core/src/airflow/config_templates/config.yml:
##########
@@ -454,6 +454,18 @@ core:
type: string
example: ~
default: ""
+ mask_secrets_content_patterns:
+ description: |
+ If set to ``True``, Airflow scans string values in Task logs and
Rendered fields for a small,
+ curated set of well-known credential formats (AWS access keys, GitHub
tokens, Slack tokens,
+ Google API keys, Stripe live keys, PEM-encoded private key blocks,
JWTs) and redacts any
+ match. This is a defense-in-depth measure that complements — but does
not replace —
+ registering secrets explicitly via ``mask_secret`` or through
Connections/Variables. It
+ is opt-in because the regex scan runs on every string that passes
through the masker.
+ version_added: 3.2.0
Review Comment:
Version added 3.4.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
