Untitled

a guest

Jun 25th, 2025

Never

Add comment

Not a member of Pastebin yet? Sign Up, it unlocks many cool features!

Go 2.37 KB | None | 0 0

raw download clone embed print report

package main
import (
"encoding/json"
"fmt"
"k8s.io/client-go/util/jsonpath"
"reflect"
"strings"
)
func redactFields(resource map[string]interface{}, annotation string) (map[string]interface{}, error) {
// Split annotation into JSONPath expressions
paths := strings.Split(annotation, ",")
j := jsonpath.New("redact")
j.AllowMissingKeys(true)
for _, path := range paths {
err := j.Parse("{" + path + "}")
if err != nil {
return nil, fmt.Errorf("failed to parse JSONPath %s: %v", path, err)
}
results, err := j.FindResults(resource)
if err != nil {
continue
}
// Traverse and redact (simplified; real implementation needs recursive traversal)
for _, result := range results {
for _, r := range result {
// Assuming r is a reflect.Value, replace with redacted value
if r.IsValid() {
// This is a placeholder; actual replacement requires traversing the map
// For simplicity, assume we’re replacing a string field
if r.Kind() == reflect.String {
value := r.String()
r.Set(reflect.ValueOf(fmt.Sprintf("REDACTED (len %d bytes)", len(value))))
}
}
}
}
}
return resource, nil
}
func main() {
// Example Kubernetes resource
resource := map[string]interface{}{
"metadata": map[string]interface{}{
"annotations": map[string]interface{}{
"werf.io/sensitive-paths": "$.data.*",
},
},
"data": map[string]interface{}{
"password": "secret123",
"token": "abcxyz",
},
}
annotation, ok := resource["metadata"].(map[string]interface{})["annotations"].(map[string]interface{})["werf.io/sensitive-paths"].(string)
if !ok {
fmt.Println("Annotation not found")
return
}
redacted, err := redactFields(resource, annotation)
if err != nil {
fmt.Printf("Error: %v\n", err)
return
}
output, err := json.MarshalIndent(redacted, "", " ")
if err != nil {
fmt.Printf("Error marshaling: %v\n", err)
return
}
fmt.Println(string(output))
}

Add Comment

Please, Sign In to add comment