Repository: godaddy/kubernetes-external-secrets
Pull request #96 (2019-06-21 00:21:58)

fix: remove logging of potentially secret value
If one misconfigures a secret these can end up in logs, which could be quite a hassle :)

Example:

```yaml
...
secretDescriptor:
  backendType: secretsManager
  data:
    - key: hello-service/credentials
      property: password
      name: password
```

hello-service/credentials from secrets manager:
```js
{
    "Name": "hello-service/credentials",
    "SecretString": "my-super-secret-password",
    ...
}
```

Would log the following 
```
Failed to JSON.parse 'my-super-secret-password': {}
```


Patch:
diff --git a/lib/backends/kv-backend.js b/lib/backends/kv-backend.js
index 92394ed..047405e 100644
--- a/lib/backends/kv-backend.js
+++ b/lib/backends/kv-backend.js
@@ -32,12 +32,14 @@ class KVBackend extends AbstractBackend {
         try {
           parsedValue = JSON.parse(value)
         } catch (err) {
-          this._logger.warn(`Failed to JSON.parse '${value}':`, err)
+          this._logger.warn(`Failed to JSON.parse value for '${secretProperty.key}',` +
+           ` please verify that your secret value is correctly formatted as JSON.` +
+           ` To use plain text secret remove the 'property: ${secretProperty.property}'`)
           return
         }
 
         if (!(secretProperty.property in parsedValue)) {
-          throw new Error(`Could not find property ${secretProperty.property} in secretProperty.key`)
+          throw new Error(`Could not find property ${secretProperty.property} in ${secretProperty.key}`)
         }
 
         return parsedValue[secretProperty.property]
diff --git a/lib/daemon.js b/lib/daemon.js
index 075c4a8..f6ead9a 100644
--- a/lib/daemon.js
+++ b/lib/daemon.js
@@ -30,14 +30,15 @@ class Daemon {
     this._pollers = {}
   }
 
-  _createPoller ({ namespace, secretDescriptors }) {
+  _createPoller ({ namespace, secretDescriptors, ownerReference }) {
     return new Poller({
       backends: this._backends,
       intervalMilliseconds: this._pollerIntervalMilliseconds,
       kubeClient: this._kubeClient,
       logger: this._logger,
       namespace,
-      secretDescriptors
+      secretDescriptors,
+      ownerReference
     })
   }
 
@@ -52,7 +53,15 @@ class Daemon {
     // NOTE(jdaeli): hash this in case resource version becomes too long?
     const id = `${name}_${resourceVersion}`
     const secretDescriptors = [{ ...secretDescriptor, name }]
-    return { id, namespace, secretDescriptors }
+    const ownerReference = {
+      apiVersion: object.apiVersion,
+      controller: true,
+      kind: object.kind,
+      name: metadata.name,
+      uid: metadata.uid
+    }
+
+    return { id, namespace, secretDescriptors, ownerReference }
   }
 
   /**
@@ -82,7 +91,8 @@ class Daemon {
 
         const poller = this._createPoller({
           namespace: descriptor.namespace,
-          secretDescriptors: descriptor.secretDescriptors
+          secretDescriptors: descriptor.secretDescriptors,
+          ownerReference: descriptor.ownerReference
         })
 
         // handle duplicate ADDED events
diff --git a/lib/poller.js b/lib/poller.js
index feae886..8c66fd1 100644
--- a/lib/poller.js
+++ b/lib/poller.js
@@ -23,14 +23,22 @@ class Poller {
    * @param {string} namespace - Kubernetes namespace.
    * @param {SecretDescriptor[]} secretDescriptors - Kubernetes secret descriptors.
    */
-  constructor ({ backends, intervalMilliseconds, kubeClient, logger, namespace, secretDescriptors }) {
+  constructor ({
+    backends,
+    intervalMilliseconds,
+    kubeClient,
+    logger,
+    namespace,
+    secretDescriptors,
+    ownerReference
+  }) {
     this._backends = backends
     this._intervalMilliseconds = intervalMilliseconds
     this._kubeClient = kubeClient
     this._logger = logger
     this._namespace = namespace
     this._secretDescriptors = secretDescriptors
-
+    this._ownerReference = ownerReference
     this._interval = null
   }
 
@@ -46,7 +54,10 @@ class Poller {
       apiVersion: 'v1',
       kind: 'Secret',
       metadata: {
-        name: secretDescriptor.name
+        name: secretDescriptor.name,
+        ownerReferences: [
+          this._ownerReference
+        ]
       },
       type: 'Opaque',
       data


Test patch:
diff --git a/lib/poller.test.js b/lib/poller.test.js
index 42fbdfa..5667660 100644
--- a/lib/poller.test.js
+++ b/lib/poller.test.js
@@ -12,6 +12,14 @@ describe('Poller', () => {
   let loggerMock
   let poller
 
+  const ownerReference = {
+    apiVersion: 'owner-api/v1',
+    controller: true,
+    kind: 'MyKind',
+    name: 'fakeSecretName',
+    uid: '4c10d879-2646-40dc-8595-d0b06b60a9ed'
+  }
+
   beforeEach(() => {
     backendMock = sinon.mock()
     kubeClientMock = sinon.mock()
@@ -27,7 +35,8 @@ describe('Poller', () => {
       intervalMilliseconds: 5000,
       kubeClient: kubeClientMock,
       logger: loggerMock,
-      namespace: 'fakeNamespace'
+      namespace: 'fakeNamespace',
+      ownerReference
     })
   })
 
@@ -72,7 +81,8 @@ describe('Poller', () => {
         apiVersion: 'v1',
         kind: 'Secret',
         metadata: {
-          name: 'fakeSecretName'
+          name: 'fakeSecretName',
+          ownerReferences: [ownerReference]
         },
         type: 'Opaque',
         data: {
@@ -154,7 +164,7 @@ describe('Poller', () => {
         secretDescriptor: {
           backendType: 'fakeBackendType',
           name: 'fakeSecretName',
-          properties: ['fakePropertyName1']
+          properties: ['fakePropertyName']
         }
       }
     })