Skip to content

Conversation

rokatyy
Copy link
Contributor

@rokatyy rokatyy commented Oct 14, 2025

📝 Description

In RabbitMQ, credentials can be included directly in the URL, which may raise security concerns for some users. This PR addresses the issue by parsing the URL during the enrichment stage and removing any credentials. Extracted username and password are then securely set in triggerConfiguration.Username and triggerConfiguration.Password.


✅ Checklist

  • I updated the documentation (if applicable)
  • I have tested the changes in this PR

🧪 Testing

vmdev and unit test


🔗 References


🚨 Breaking Changes?

  • Yes (explain below)
  • No

🔍️ Additional Notes

Function was deployed as usually with creds specified in URL. After deployment, URL doesn't have creds and password and username are in separate fields (password masked - both in UI and CRD):

UI:
Screenshot 2025-10-14 at 14 29 21

CRD:

      attributes:
        exchangeName: test_ex
        prefetchCount: 2
        queueName: task_queue
      class: ""
      kind: rabbit-mq
      mode: sync
      name: rabbit-trigger
      password: $ref:/spec/triggers/rabbit-trigger/password
      url: amqp://my-rabbitmq.default-tenant.svc.cluster.local:5672
      username: user     

@github-actions github-actions bot added the docs label Oct 14, 2025
Copy link
Collaborator

@weilerN weilerN left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good, a minor comment inline =]

Copy link
Collaborator

@weilerN weilerN left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

Comment on lines 1845 to 1846
}
func (ap *Platform) enrichRabbitMQTrigger(ctx context.Context, triggerName string, triggerInstance *functionconfig.Trigger) error {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add newline before function

Comment on lines 62 to 64
Both configurations are supported.
During the enrichment stage, if credentials are provided within the URL, they are automatically extracted and assigned to `username` and `password` fields in the trigger configuration.
The URL is then sanitized (i.e., credentials are removed) to prevent sensitive data from being exposed in logs or configurations.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add a note about the precedence - if the URL contains user/pass they will override existing user/pass configuration in the trigger spec

@rokatyy rokatyy requested a review from TomerShor October 15, 2025 10:21
@rokatyy rokatyy merged commit a714ac8 into nuclio:development Oct 15, 2025
19 of 20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants