ddreyer opened a new pull request, #19884: URL: https://github.com/apache/pinot/pull/19884
`Obfuscator.DEFAULT` only masks keys that end in `secret`, `secret key`, `api key`, `password`, `keytab` or `token`. Several common credentials end in something else, so they get printed in plaintext wherever `DEFAULT` is used: the startup config dump (`PinotConfiguration`, `PinotAppConfigs`) and the minion task executors' "Starting task ... with configs" log lines. For example, `SegmentGenerationAndPushTask` logs `input.fs.prop.accessKey` verbatim while masking the `secretKey` next to it. This adds suffix-anchored default patterns for: - the AWS access key and key ID (`accessKey`, `accessKeyId`, `fs.s3a.access.key`, `restAccessKeyId`) - Kafka's `sasl.jaas.config`, which embeds the SASL password - Confluent's `basic.auth.user.info`, a literal `user:password` - private keys and GCP service-account key material (`privateKey`, `private_key_id`, `jsonKey`, `keyFile`, `keyContentBase64`) - `credential` / `credentials`, `passwd` and `passphrase` The patterns stay anchored on the end of the key, so names an operator reads to debug authentication, such as `pinot.broker.auth.provider.class`, `fs.s3a.aws.credentials.provider` and `basic.auth.credentials.source`, stay readable. A test covers both the newly masked keys and those structural names. This is a companion to #19555, which redacts credentials from audit log payloads with its own, more aggressive rules, since over-masking costs nothing there. `ObfuscatorTest` and `PinotConfigurationTest` pass locally and checkstyle is clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
