{"action":"created","issue":{"url":"https://api.github.com/repos/saltstack/salt/issues/28384","labels_url":"https://api.github.com/repos/saltstack/salt/issues/28384/labels{/name}","comments_url":"https://api.github.com/repos/saltstack/salt/issues/28384/comments","events_url":"https://api.github.com/repos/saltstack/salt/issues/28384/events","html_url":"https://github.com/saltstack/salt/pull/28384","id":113938305,"number":28384,"title":"Sanitation of secrets from returner output","user":{"login":"kmshultz","id":2200073,"avatar_url":"https://avatars.githubusercontent.com/u/2200073?v=3","gravatar_id":"","url":"https://api.github.com/users/kmshultz","html_url":"https://github.com/kmshultz","followers_url":"https://api.github.com/users/kmshultz/followers","following_url":"https://api.github.com/users/kmshultz/following{/other_user}","gists_url":"https://api.github.com/users/kmshultz/gists{/gist_id}","starred_url":"https://api.github.com/users/kmshultz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kmshultz/subscriptions","organizations_url":"https://api.github.com/users/kmshultz/orgs","repos_url":"https://api.github.com/users/kmshultz/repos","events_url":"https://api.github.com/users/kmshultz/events{/privacy}","received_events_url":"https://api.github.com/users/kmshultz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/saltstack/salt/labels/Core","name":"Core","color":"fef2c0"},{"url":"https://api.github.com/repos/saltstack/salt/labels/Expert%20Change","name":"Expert Change","color":"5319e7"},{"url":"https://api.github.com/repos/saltstack/salt/labels/Loader","name":"Loader","color":"006b75"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-10-28T22:21:11Z","updated_at":"2015-10-29T15:25:22Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/saltstack/salt/pulls/28384","html_url":"https://github.com/saltstack/salt/pull/28384","diff_url":"https://github.com/saltstack/salt/pull/28384.diff","patch_url":"https://github.com/saltstack/salt/pull/28384.patch"},"body":"This feature allows a user to prevent secrets in pillar from winding stored in any sensitive datastores via returners.\r\n\r\nHere's a partial `minion_config` which uses the feature:\r\n\r\n```yaml\r\n# specify the pillar namespaces which contain the secrets you'd like redacted.\r\n# this can be a string (for a single namespace) or a list.\r\nreturner_sanitize.secrets_pillars:\r\n  - master:pillar_roots\r\n\r\n# specify any \"secrets\" expected in your secrets_pillars above which are\r\n# benign and need not be redacted. e.g. Perhaps your pillar contains\r\n# some common words, such as 'root', which could make a mess\r\n# of many job outputs if redacted\r\nreturner_sanitize.secrets_whitelist:\r\n  - /srv/spm/pillar\r\n\r\n# all returners' `returner` functions will be sanitized, except \r\n# those returners in this list\r\nreturner_sanitize.returner_whitelist:\r\n  - local_cache\r\n```\r\n\r\nThe only config option *required* to activate the feature is `returner_sanitize.secrets_pillars`.\r\n\r\nI tested locally using a simple script, `sanitize-returner.py`:\r\n\r\n```python\r\nfrom salt.cli.caller import BaseCaller\r\n\r\nrunner = BaseCaller(salt.config.minion_config('/Users/kent/minion_config'))\r\nrunner.opts['fun'] = 'pillar.item'\r\nrunner.opts['arg'] = [sys.argv[1]]\r\nrunner.opts['local'] = True\r\nrunner.opts['metadata'] = None\r\nrunner.opts['return'] = 'local'\r\nrunner.run()\r\n```\r\n\r\nAnd here's an example run (which uses the `local` returner, as you can see):\r\n\r\n```\r\n$ ~/sanitize-returner.py master:pillar_roots\r\n{u'fun_args': [u'master:pillar_roots'], u'jid': u'20151028151656874983', u'return': {u'master:pillar_roots': {u'base': [u'REDACTED', u'/srv/spm/pillar', u'REDACTED']}}, u'retcode': 0, u'success': True, u'fun': u'pillar.item', u'id': u''}\r\nlocal:\r\n    ----------\r\n    master:pillar_roots:\r\n        ----------\r\n        base:\r\n            - /srv/pillar\r\n            - /srv/spm/pillar\r\n            - /srv/pillar/foo\r\n```\r\n\r\nI've played around with the script and config a bit to test the code's features as thoroughly as I can, but I haven't written any tests for the feature yet.\r\n\r\nI haven't filed an Issue for this; I can do that if you like. Please let me know what you all think!"},"comment":{"url":"https://api.github.com/repos/saltstack/salt/issues/comments/152214136","html_url":"https://github.com/saltstack/salt/pull/28384#issuecomment-152214136","issue_url":"https://api.github.com/repos/saltstack/salt/issues/28384","id":152214136,"user":{"login":"cachedout","id":111616,"avatar_url":"https://avatars.githubusercontent.com/u/111616?v=3","gravatar_id":"","url":"https://api.github.com/users/cachedout","html_url":"https://github.com/cachedout","followers_url":"https://api.github.com/users/cachedout/followers","following_url":"https://api.github.com/users/cachedout/following{/other_user}","gists_url":"https://api.github.com/users/cachedout/gists{/gist_id}","starred_url":"https://api.github.com/users/cachedout/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cachedout/subscriptions","organizations_url":"https://api.github.com/users/cachedout/orgs","repos_url":"https://api.github.com/users/cachedout/repos","events_url":"https://api.github.com/users/cachedout/events{/privacy}","received_events_url":"https://api.github.com/users/cachedout/received_events","type":"User","site_admin":false},"created_at":"2015-10-29T15:25:21Z","updated_at":"2015-10-29T15:25:21Z","body":"I've been looking at this today and so far it looks great! I would definietely like to see us get some test coverage in ASAP for this, so if you'd like to open another issue on that, it would be great. I'm now going to review and hopefully merge #28389 and then we'll re-run the tests on this one. Thanks very much for your good work here. I think this will be an excellent addition to Salt!"}}