rzo1 opened a new pull request, #9069:
URL: https://github.com/apache/storm/pull/9069
## What
Nimbus serves configuration to clients from three operations, and they did
not agree on what to redact:
| operation | authorization tier | redaction |
| --- | --- | --- |
| `getNimbusConf` | `nimbus.users` | `maskCredentials` |
| `getTopologyConf` | topology read-only | `maskPasswords` + Blowfish key |
| `getTopologyPageInfo` | topology read-only | none |
`getTopologyPageInfo` is the one that serves the *merged* map —
`Utils.merge(conf, common.topoConf)` — so it
returned strictly more configuration than either of the other two while
redacting the least. The UI renders
that map as the `configuration` field of the topology page and of the
metrics response.
## Change
One private helper, `maskCredentialsForApi`, with both topology-facing
operations routed through it:
- `getTopologyPageInfo` masks before serializing into
`TopologyPageInfo.topology_conf`.
- `getTopologyConf` moves from `maskPasswords` to `maskCredentials`, which
additionally covers keys that no
annotated field declares — plugins read their own keys straight out of the
map, so the annotation scan
cannot see them.
- The Blowfish tuple serializer key is handled once inside the helper
instead of being repeated at each call
site. Its constant lives outside the config classes and its name matches
no credential pattern, so neither
mechanism picks it up on its own.
Masking applies to the copy that gets serialized. The daemon's own
configuration and the stored topology
configuration are left alone, and workers keep reading real values from the
blobstore-distributed
configuration rather than from these responses.
## Compatibility
`TopologyPageInfo.topology_conf` has exactly two consumers, both display
paths in `UIHelpers`
(`getTopologySummary` and `unpackTopologyInfo`). `UIHelpers` reads
`topology.message.timeout.secs` back out of
the parsed map; that value is an Integer and its key matches no credential
pattern, so it is unaffected.
`storm-loadgen`'s `CaptureLoad` round-trips a topology configuration and
will now capture `*****` for a few
more keys than before. That is the same trade already accepted when
`getTopologyConf` started masking, and
credentials should be re-provisioned per submission in any case.
## Testing
`NimbusGetTopologyPageInfoTest` puts credential-shaped keys in both the
daemon configuration and the stored
topology configuration, calls `getTopologyPageInfo`, and asserts that all of
them come back masked while
`topology.name`, `topology.workers` and `topology.message.timeout.secs` are
served untouched and neither
source map was mutated. The test was confirmed to fail without the
production change.
`mvn -pl storm-server test` is green for `NimbusGetTopologyPageInfoTest`,
`NimbusGetTopologyConfTest` and
`NimbusGetNimbusConfTest`, with the project checkstyle running.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
