utilities

func HashString ¶

func HashString(input string) string

HashString creates a SHA-256 hash of the input string and returns it as a hex string

func MaskSensitiveFields ¶

func MaskSensitiveFields(data map[string]interface{})

MaskSensitiveFields masks common sensitive fields in a map

func MaskSensitiveFieldsWithList ¶

func MaskSensitiveFieldsWithList(data map[string]interface{}, sensitiveFields []string)

MaskSensitiveFieldsWithList masks sensitive fields in a map based on a provided list of field names

func MaskString ¶

func MaskString(s string) string

MaskString masks a string by showing parts of the beginning and end while hiding the middle portion with asterisks

func SanitizeLabelValue ¶

func SanitizeLabelValue(v string) string

SanitizeLabelValue produces a string guaranteed to satisfy Kubernetes' label-value validation rule:

(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?

The rule allows: empty string, alphanumerics, '-', '_', '.', with the constraint that the first and last character must be alphanumeric and the total length is at most 63.

API consumers commonly pass values like "python:3.11" or "ghcr.io/foo/bar:tag" (image references). Without sanitization, the API server rejects the CRD with HTTP 500 at creation time; this is exactly the bug surfaced by the worklog 0035 cluster validation:

"Workspace.llmsafespaces.dev is invalid: metadata.labels: Invalid value:
 \"python:3.11\": a valid label must be an empty string or consist of
 alphanumeric characters, '-', '_' or '.', and must start and end with
 an alphanumeric character"

Strategy:

1. Replace every disallowed character with '_'. We do not try to preserve information; the label is for grouping/filtering only and users should consult the spec.runtime field for the canonical value.
2. Truncate to 63 chars.
3. Trim leading/trailing non-alphanumerics so the result satisfies the start/end-with-alphanumeric rule.

An input that is entirely disallowed characters (e.g. "::::") returns the empty string, which is itself a valid label value.