filter out NOOBAA_ROOT_SECRET from env vars to avoid exposing it in pod spec#1753
Conversation
📝 WalkthroughWalkthroughSetDesiredCoreEnv in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Suggested reviewers
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (13)
🔇 Additional comments (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
pkg/system/phase2_creating.go (1)
441-454: Fix typo and consider extracting duplicate filtering logic.Minor issues:
- Typo in comment: "older then 4.21" should be "older than 4.21"
- This exact filtering pattern is duplicated in
pkg/system/phase4_configuring.go(lines 372-380). Consider extracting it to a helper function likefilterEnvVar(envVars []corev1.EnvVar, nameToFilter string) []corev1.EnvVarto follow the DRY principle.The filtering logic itself is correct and uses the idiomatic in-place filtering pattern.
🔎 Proposed refactor to eliminate duplication
Add a helper function at the package level:
// filterEnvVar removes environment variables with the specified name from the slice func filterEnvVar(envVars []corev1.EnvVar, nameToFilter string) []corev1.EnvVar { if len(envVars) == 0 { return envVars } filtered := envVars[:0] for _, env := range envVars { if env.Name != nameToFilter { filtered = append(filtered, env) } } return filtered }Then replace the filtering blocks with:
- if len(c.Env) > 0 { - filtered := c.Env[:0] - for _, env := range c.Env { - if env.Name != "NOOBAA_ROOT_SECRET" { - filtered = append(filtered, env) - } - } - c.Env = filtered - } + c.Env = filterEnvVar(c.Env, "NOOBAA_ROOT_SECRET")Apply the same change in both files.
pkg/system/phase4_configuring.go (1)
367-381: Fix typo and consider extracting duplicate filtering logic.Minor issues:
- Typo in comment: "older then 4.21" should be "older than 4.21"
- This filtering logic is duplicated from
pkg/system/phase2_creating.go(lines 446-454). Extract to a shared helper function to avoid code duplication.The filtering logic itself is correct. The placement here (after
util.MergeEnvArraysbut before the env var processing loop) ensures the filter applies to the endpoint container's environment regardless of whetherJoinSecretis set.🔎 Proposed refactor
See the refactoring suggestion in the review comment for
pkg/system/phase2_creating.go:441-454to extract a sharedfilterEnvVarhelper function.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
pkg/system/phase2_creating.gopkg/system/phase4_configuring.go
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (13)
- GitHub Check: run-kms-dev-test
- GitHub Check: run-admission-test
- GitHub Check: run-kms-tls-token-test
- GitHub Check: run-azure-vault-test
- GitHub Check: run-operator-tests
- GitHub Check: golangci-lint
- GitHub Check: run-hac-test
- GitHub Check: run-core-config-map-tests
- GitHub Check: run-cli-tests
- GitHub Check: run-kms-key-rotate-test
- GitHub Check: cnpg-deployment-test
- GitHub Check: run-kms-tls-sa-test
- GitHub Check: run-kms-kmip-test
ce5da53 to
d3a8902
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
pkg/system/phase2_creating.go
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (13)
- GitHub Check: cnpg-deployment-test
- GitHub Check: run-kms-tls-sa-test
- GitHub Check: run-kms-kmip-test
- GitHub Check: run-operator-tests
- GitHub Check: run-core-config-map-tests
- GitHub Check: run-hac-test
- GitHub Check: run-kms-tls-token-test
- GitHub Check: run-kms-key-rotate-test
- GitHub Check: golangci-lint
- GitHub Check: run-kms-dev-test
- GitHub Check: run-cli-tests
- GitHub Check: run-admission-test
- GitHub Check: run-azure-vault-test
d3a8902 to
b569fb0
Compare
e909c24 to
e5112cc
Compare
…d spec - ilter out NOOBAA_ROOT_SECRET from env vars to avoid exposing it in pod spec Signed-off-by: liranmauda <liran.mauda@gmail.com>
e5112cc to
a0dffcf
Compare
Explain the changes
Issues: Fixed #xxx / Gap #xxx
Summary by CodeRabbit
Bug Fixes
Security
✏️ Tip: You can customize this high-level summary in your review settings.