Documentation
¶
Overview ¶
Package redact turns transport errors into messages that carry no address and no secret.
pkg/k8s and pkg/registry both wrap network clients whose errors embed the peer they talked to: a *url.Error carries the full URL, a *net.OpError the dial address, a *net.DNSError the name looked up, an x509 error the hostnames on the certificate. Those strings are exactly what AGENTS.md §4.4 keeps out of every public surface (R-004), so no adaptor returns a client error unchanged. Error walks the wrap chain down to the cause that says *what* went wrong (refused, timed out, no such host, unknown authority) and drops every field that says *where*. The adaptors add the where themselves, in terms they are allowed to print: a context name, a namespace, a registry host from an image reference the operator already holds.
The hide list is the second guard (R-002): any of those strings, typically credentials the caller has in hand, is replaced wherever it appears in the final message. Both guards are structural — a new error type that slips past the type switch still cannot carry a listed secret, and the tests pin both.
Register adds a third guard, process-wide: pkg/k8s and pkg/registry call it the moment they load a credential value (an env token, a cluster secret's password, `op`'s output), independent of whichever local hide list the call site that later errors remembers to thread through. Every Error and Strings call scrubs the registered set in addition to its own hide arguments, so a message built two or three calls away from where the credential was read — a warning in pkg/resolve, the CLI's plan printer — is still caught at the process boundary rather than only at the adaptor that happened to load it. Register("") is a deliberate no-op: an empty string must never become "hide everything".
Index ¶
Constants ¶
const Redacted = "<redacted>"
Redacted replaces every hidden string in a message.
Variables ¶
This section is empty.
Functions ¶
func Error ¶
Error returns a message for err with addresses, hostnames and URLs removed and every non-empty string in hide, plus every value ever passed to Register, replaced by Redacted. A nil err yields "".
func Host ¶
Host returns every spelling of a server address worth scrubbing from a message: the string as given, its host[:port] with any "scheme://" prefix stripped, and the bare host alone with the port removed too. The last form matters because a typed error (x509.HostnameError and the like) is already rendered as static text by describe, but an error that reaches this package by a route the type switch doesn't cover can still spell the bare host as plain text — "x509: certificate is valid for …, not 192.0.2.10" — and a hide list built only from host:port never matches that. raw == "" returns nil.
Types ¶
This section is empty.
Source Files