github/woodpecker
1
0
Fork 0
mirror of https://github.com/woodpecker-ci/woodpecker.git synced 2025-09-06 03:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent secrets from leaking to Kubernetes API Server logs (#5305)

Browse Source
This commit is contained in:
Harri Avellan
2025-07-14 17:45:13 +03:00
committed by GitHub
parent b382287170
commit 5c00b9d74b
9 changed files with 369 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pipeline/backend/kubernetes/kubernetes.go
View File

@@ -233,6 +233,13 @@ func (e *kube) StartStep(ctx context.Context, step *types.Step, taskUUID string)
}
}
if needsStepSecret(step) {
err = startStepSecret(ctx, e, step)
if err != nil {
return err
}
}
log.Trace().Str("taskUUID", taskUUID).Msgf("starting step: %s", step.Name)
_, err = startPod(ctx, e, step, options)
return err
@@ -398,6 +405,13 @@ func (e *kube) DestroyStep(ctx context.Context, step *types.Step, taskUUID strin
}
}
if needsStepSecret(step) {
err := stopStepSecret(ctx, e, step, defaultDeleteOptions)
if err != nil {
errs = append(errs, err)
}
}
err := stopPod(ctx, e, step, defaultDeleteOptions)
if err != nil {
errs = append(errs, err)