-
Notifications
You must be signed in to change notification settings - Fork 552
[RabbitMQ] Mask credentials from url #3835
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looking good, a minor comment inline =]
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 👍
} | ||
func (ap *Platform) enrichRabbitMQTrigger(ctx context.Context, triggerName string, triggerInstance *functionconfig.Trigger) error { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
add newline before function
docs/reference/triggers/rabbitmq.md
Outdated
Both configurations are supported. | ||
During the enrichment stage, if credentials are provided within the URL, they are automatically extracted and assigned to `username` and `password` fields in the trigger configuration. | ||
The URL is then sanitized (i.e., credentials are removed) to prevent sensitive data from being exposed in logs or configurations. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Add a note about the precedence - if the URL contains user/pass they will override existing user/pass configuration in the trigger spec
📝 Description
In RabbitMQ, credentials can be included directly in the URL, which may raise security concerns for some users. This PR addresses the issue by parsing the URL during the enrichment stage and removing any credentials. Extracted username and password are then securely set in triggerConfiguration.Username and triggerConfiguration.Password.
✅ Checklist
🧪 Testing
vmdev and unit test
🔗 References
🚨 Breaking Changes?
🔍️ Additional Notes
Function was deployed as usually with creds specified in URL. After deployment, URL doesn't have creds and password and username are in separate fields (password masked - both in UI and CRD):
UI:

CRD: