Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[MD]Use placeholder for data source credentials fields when export saved object #6928

Merged

Conversation

zhongnansu
Copy link
Member

@zhongnansu zhongnansu commented Jun 5, 2024

Description

We want to avoid exposing data source credentials during export, even tho they are encrypted values.

The data source objects in the exported nd.json file will look like below, with credentials fields replaced with placeholder values. Import will still succeed.


{
  "attributes": {
    "auth": {
      "type": "username_password",
      "credentials": {
            "password": "pleaseUpdateCredentials",
            "username": "pleaseUpdateCredentials"
      },
    },
    "dataSourceVersion": "",
    "description": "",
    "endpoint": "https://search-new-m6-nbkrrsakxmzqk3oay3olromnzi.us-west-2.es.amazonaws.com/",
    "installedPlugins": [],
    "title": "test1"
  },
  "id": "18abe7e0-2297-11ef-b143-fdc11e1ac86d",
  "migrationVersion": {
    "data-source": "2.4.0"
  },
  "references": [],
  "type": "data-source",
  "updated_at": "2024-06-04T17:23:02.110Z",
  "version": "WzQsMV0="
}

iShot_2024-06-05_13 20 26

Issues Resolved

#6892

Screenshot

Testing the changes

Changelog

  • feat: [MD]Use placeholder for data source credentials fields when export saved object

Check List

  • All tests pass
    • yarn test:jest
    • yarn test:jest_integration
  • New functionality includes testing.
  • New functionality has been documented.
  • Update CHANGELOG.md
  • Commits are signed per the DCO using --signoff

Copy link
Contributor

github-actions bot commented Jun 5, 2024

❌ Empty Changelog Section

The Changelog section in your PR description is empty. Please add a valid changelog entry or entries. If you did add a changelog entry, check to make sure that it was not accidentally included inside the comment block in the Changelog section.

Copy link
Contributor

github-actions bot commented Jun 5, 2024

❌ Empty Changelog Section

The Changelog section in your PR description is empty. Please add a valid changelog entry or entries. If you did add a changelog entry, check to make sure that it was not accidentally included inside the comment block in the Changelog section.

opensearch-changeset-bot bot added a commit to zhongnansu/OpenSearch-Dashboards that referenced this pull request Jun 5, 2024
@zhongnansu zhongnansu force-pushed the export-dummy-dendential branch 2 times, most recently from 5ed194d to 438daa7 Compare June 5, 2024 19:22
Copy link

codecov bot commented Jun 5, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 67.42%. Comparing base (f51f652) to head (fe8a800).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #6928   +/-   ##
=======================================
  Coverage   67.42%   67.42%           
=======================================
  Files        3443     3443           
  Lines       67770    67782   +12     
  Branches    11023    11027    +4     
=======================================
+ Hits        45693    45703   +10     
- Misses      19412    19413    +1     
- Partials     2665     2666    +1     
Flag Coverage Δ
Linux_1 33.10% <7.69%> (-0.01%) ⬇️
Linux_2 55.06% <100.00%> (+0.02%) ⬆️
Linux_3 45.21% <7.69%> (-0.02%) ⬇️
Linux_4 34.85% <7.69%> (-0.01%) ⬇️
Windows_1 33.12% <7.69%> (-0.01%) ⬇️
Windows_2 55.03% <100.00%> (+0.02%) ⬆️
Windows_3 45.23% <7.69%> (-0.02%) ⬇️
Windows_4 34.85% <7.69%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@BionIT
Copy link
Collaborator

BionIT commented Jun 5, 2024

@zhongnansu is this PR ready for review?

opensearch-changeset-bot bot added a commit to zhongnansu/OpenSearch-Dashboards that referenced this pull request Jun 5, 2024
const hasCredentials = auth && auth.credentials;
const updatedCredentials = hasCredentials
? Object.keys(auth.credentials).reduce((acc, key) => {
acc[key] = DATA_SOURCE_CREDENTIALS_PLACEHOLDER;
Copy link
Member

@xinruiba xinruiba Jun 5, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this change~
Just one question, SigV4 and TokenExchange also have regions under credential attribute, will this logic have any side effect?

Maybe we can also test SigV4 scenario while waiting CI to complete? Thanks!

Copy link
Member Author

@zhongnansu zhongnansu Jun 5, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

every field under "credentials" attributes will be replaced to use placeholder value, including region. I have tested sigV4 case, you can find it from the video. The exported sigV4 data source will look like this

{
   "attributes": {
      "auth": {
         "credentials": {
            "accessKey": "pleaseUpdateCredentials",
            "region": "pleaseUpdateCredentials",
            "secretKey": "pleaseUpdateCredentials",
            "service": "pleaseUpdateCredentials"
         },
         "type": "sigv4"
      },
      "dataSourceVersion": "",
      "description": "",
      "endpoint": "https://mjdty4727oifwax8ycdk.us-west-2.aoss.amazonaws.com",
      "installedPlugins": [],
      "title": "testSigV4"
   },
   "id": "7f8e13c0-2378-11ef-a345-bd55de69299f",
   "migrationVersion": {
      "data-source": "2.4.0"
   },
   "references": [],
   "type": "data-source",
   "updated_at": "2024-06-05T20:16:31.484Z",
   "version": "WzQsMV0="
}

@zhongnansu zhongnansu merged commit 0188efe into opensearch-project:main Jun 5, 2024
68 checks passed
opensearch-trigger-bot bot pushed a commit that referenced this pull request Jun 5, 2024
…ved object (#6928)

* [MD]Use placeholder for data source credentials fields  when exporting saved object

Signed-off-by: Zhongnan Su <[email protected]>

* Changeset file for PR #6928 created/updated

---------

Signed-off-by: Zhongnan Su <[email protected]>
Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com>
(cherry picked from commit 0188efe)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
zhongnansu pushed a commit that referenced this pull request Jun 5, 2024
…ved object (#6928) (#6931)

* [MD]Use placeholder for data source credentials fields  when exporting saved object



* Changeset file for PR #6928 created/updated

---------



(cherry picked from commit 0188efe)

Signed-off-by: Zhongnan Su <[email protected]>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants