Make it easier to add a SanitizingFunction to mask properties with specific names #39243
Labels
type: enhancement
A general enhancement
Milestone
Comments
philwebb
added
the
for: team-meeting
|
We're going to start by investigating option 2 and making it easy to build a |
philwebb
removed
the
for: team-meeting
|
Hi, is there a workaround? I want 2.7's behavior with |
@guai you can implement your own That said, I'm still hoping for a spring provided solution that makes it easier to create a |
@philwebb is there any update on this? If there is a branch I could look at or contribute to I'd be happy to pitch in for functionality that improves my codebase(s). |
|
@datagitlies We haven't had the chance to look at this one in any detail yet. I'm afraid we're currently heads down on the 3.3 release. If you have a proposal, feel free to submit a pull-request. |
j-sandy
added a commit
to j-sandy/kork
that referenced
this issue
Dec 12, 2024
…ith spring boot upgrade to 3.x
While upgrading the spring boot to 3.0.13 and spring cloud 2022.0.5, encountered the below errors during build process of kork-actuator module:
```
> Task :kork-actuator:compileJava FAILED
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/ActuatorEndpointsConfiguration.java:26: error: cannot find symbol
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
^
symbol: class WebSecurityConfigurerAdapter
location: package org.springframework.security.config.annotation.web.configuration
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/ActuatorEndpointsConfiguration.java:30: error: cannot find symbol
public class ActuatorEndpointsConfiguration extends WebSecurityConfigurerAdapter {
^
symbol: class WebSecurityConfigurerAdapter
2 errors
```
With spring boot upgrade, spring security also upgrades from 5.x to 6.x. As per the migration [steps](https://www.baeldung.com/spring-security-migrate-5-to-6), `WebSecurityConfigurerAdapter` has been removed. So, it is not required to be extended, instead bean can be registered.
```
> Task :kork-actuator:compileJava FAILED
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/endpoint/ResolvedEnvironmentEndpoint.java:45: error: invalid method reference
.ifPresent(sanitizer::setKeysToSanitize);
^
cannot find symbol
symbol: method setKeysToSanitize(T)
location: class Sanitizer
where T is a type-variable:
T extends Object declared in class Optional
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/endpoint/ResolvedEnvironmentEndpoint.java:56: error: incompatible types: String cannot be converted to SanitizableData
return sanitizer.sanitize(property, environment.getProperty(property));
^
Note: Some messages have been simplified; recompile with -Xdiags:verbose to get full output
2 errors
```
In spring boot 3, changes are introduced in sanitization of actuator [endpoints](https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.0-Migration-Guide#actuator-endpoints-sanitization).
Default `Sanitizer` implementation has been removed and replaced with `SanitizingFunction`.
spring-projects/spring-boot#33448
spring-projects/spring-boot#39243
spring-projects/spring-boot#32156
So, added the `ActuatorSanitizingFunction` class to provide the default implementation of `SanitizingFunction`.
j-sandy
added a commit
to j-sandy/kork
that referenced
this issue
Dec 17, 2024
…ith spring boot upgrade to 3.x
While upgrading the spring boot to 3.0.13 and spring cloud 2022.0.5, encountered the below errors during build process of kork-actuator module:
```
> Task :kork-actuator:compileJava FAILED
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/ActuatorEndpointsConfiguration.java:26: error: cannot find symbol
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
^
symbol: class WebSecurityConfigurerAdapter
location: package org.springframework.security.config.annotation.web.configuration
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/ActuatorEndpointsConfiguration.java:30: error: cannot find symbol
public class ActuatorEndpointsConfiguration extends WebSecurityConfigurerAdapter {
^
symbol: class WebSecurityConfigurerAdapter
2 errors
```
With spring boot upgrade, spring security also upgrades from 5.x to 6.x. As per the migration [steps](https://www.baeldung.com/spring-security-migrate-5-to-6), `WebSecurityConfigurerAdapter` has been removed. So, it is not required to be extended, instead bean can be registered.
```
> Task :kork-actuator:compileJava FAILED
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/endpoint/ResolvedEnvironmentEndpoint.java:45: error: invalid method reference
.ifPresent(sanitizer::setKeysToSanitize);
^
cannot find symbol
symbol: method setKeysToSanitize(T)
location: class Sanitizer
where T is a type-variable:
T extends Object declared in class Optional
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/endpoint/ResolvedEnvironmentEndpoint.java:56: error: incompatible types: String cannot be converted to SanitizableData
return sanitizer.sanitize(property, environment.getProperty(property));
^
Note: Some messages have been simplified; recompile with -Xdiags:verbose to get full output
2 errors
```
In spring boot 3, changes are introduced in sanitization of actuator [endpoints](https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.0-Migration-Guide#actuator-endpoints-sanitization).
Default `Sanitizer` implementation has been removed and replaced with `SanitizingFunction`.
spring-projects/spring-boot#33448
spring-projects/spring-boot#39243
spring-projects/spring-boot#32156
So, added the `ActuatorSanitizingFunction` class to provide the default implementation of `SanitizingFunction`.
j-sandy
added a commit
to j-sandy/kork
that referenced
this issue
Dec 19, 2024
…ith spring boot upgrade to 3.x
While upgrading the spring boot to 3.0.13 and spring cloud 2022.0.5, encountered the below errors during build process of kork-actuator module:
```
> Task :kork-actuator:compileJava FAILED
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/ActuatorEndpointsConfiguration.java:26: error: cannot find symbol
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
^
symbol: class WebSecurityConfigurerAdapter
location: package org.springframework.security.config.annotation.web.configuration
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/ActuatorEndpointsConfiguration.java:30: error: cannot find symbol
public class ActuatorEndpointsConfiguration extends WebSecurityConfigurerAdapter {
^
symbol: class WebSecurityConfigurerAdapter
2 errors
```
With spring boot upgrade, spring security also upgrades from 5.x to 6.x. As per the migration [steps](https://www.baeldung.com/spring-security-migrate-5-to-6), `WebSecurityConfigurerAdapter` has been removed. So, it is not required to be extended, instead bean can be registered.
```
> Task :kork-actuator:compileJava FAILED
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/endpoint/ResolvedEnvironmentEndpoint.java:45: error: invalid method reference
.ifPresent(sanitizer::setKeysToSanitize);
^
cannot find symbol
symbol: method setKeysToSanitize(T)
location: class Sanitizer
where T is a type-variable:
T extends Object declared in class Optional
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/endpoint/ResolvedEnvironmentEndpoint.java:56: error: incompatible types: String cannot be converted to SanitizableData
return sanitizer.sanitize(property, environment.getProperty(property));
^
Note: Some messages have been simplified; recompile with -Xdiags:verbose to get full output
2 errors
```
In spring boot 3, changes are introduced in sanitization of actuator [endpoints](https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.0-Migration-Guide#actuator-endpoints-sanitization).
Default `Sanitizer` implementation has been removed and replaced with `SanitizingFunction`.
spring-projects/spring-boot#33448
spring-projects/spring-boot#39243
spring-projects/spring-boot#32156
So, added the `ActuatorSanitizingFunction` class to provide the default implementation of `SanitizingFunction`.
j-sandy
added a commit
to j-sandy/kork
that referenced
this issue
Dec 19, 2024
…ith spring boot upgrade to 3.x
While upgrading the spring boot to 3.0.13 and spring cloud 2022.0.5, encountered the below errors during build process of kork-actuator module:
```
> Task :kork-actuator:compileJava FAILED
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/ActuatorEndpointsConfiguration.java:26: error: cannot find symbol
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
^
symbol: class WebSecurityConfigurerAdapter
location: package org.springframework.security.config.annotation.web.configuration
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/ActuatorEndpointsConfiguration.java:30: error: cannot find symbol
public class ActuatorEndpointsConfiguration extends WebSecurityConfigurerAdapter {
^
symbol: class WebSecurityConfigurerAdapter
2 errors
```
With spring boot upgrade, spring security also upgrades from 5.x to 6.x. As per the migration [steps](https://www.baeldung.com/spring-security-migrate-5-to-6), `WebSecurityConfigurerAdapter` has been removed. So, it is not required to be extended, instead bean can be registered.
```
> Task :kork-actuator:compileJava FAILED
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/endpoint/ResolvedEnvironmentEndpoint.java:45: error: invalid method reference
.ifPresent(sanitizer::setKeysToSanitize);
^
cannot find symbol
symbol: method setKeysToSanitize(T)
location: class Sanitizer
where T is a type-variable:
T extends Object declared in class Optional
/kork/kork-actuator/src/main/java/com/netflix/spinnaker/kork/actuator/endpoint/ResolvedEnvironmentEndpoint.java:56: error: incompatible types: String cannot be converted to SanitizableData
return sanitizer.sanitize(property, environment.getProperty(property));
^
Note: Some messages have been simplified; recompile with -Xdiags:verbose to get full output
2 errors
```
In spring boot 3, changes are introduced in sanitization of actuator [endpoints](https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.0-Migration-Guide#actuator-endpoints-sanitization).
Default `Sanitizer` implementation has been removed and replaced with `SanitizingFunction`.
spring-projects/spring-boot#33448
spring-projects/spring-boot#39243
spring-projects/spring-boot#32156
So, added the `ActuatorSanitizingFunction` class to provide the default implementation of `SanitizingFunction`.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
See #39094 (comment) for details.
We removed default sanitization in #33448 but didn't offer an easy way for those that were happy with that approach to apply it again. This means that a lot users will be copying similar code.
A couple of options that come to mind are:
SanitizingFunctionthat makes it easier to create a@BeanThe text was updated successfully, but these errors were encountered: