OTA-2025: Redact proxy URL credentials from AgenticRun readiness data - #1442
OTA-2025: Redact proxy URL credentials from AgenticRun readiness data#1442jrangelramos wants to merge 1 commit into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@jrangelramos: This pull request references OTA-2025 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
WalkthroughThe network readiness check now removes proxy credentials from HTTP and HTTPS results. It preserves empty and credential-free values, marks invalid URLs as ChangesReadiness proxy redaction
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/readiness/checks_test.go`:
- Around line 742-746: Update the proxy redaction test around the https_proxy
assertion to always compare proxy["https_proxy"] with tt.wantHTTPS, including
empty expectations. Extend the test cases with the hostless proxy input
http:admin:s3cret@proxy.corp:8080 and expect [configured], preserving coverage
of fail-closed redaction.
In `@pkg/readiness/network.go`:
- Around line 81-86: Update the proxy URL sanitization flow after url.Parse and
before returning u.String() to validate that the parsed URL has both a scheme
and host; return "[configured]" when either is missing. Preserve removing u.User
before returning valid sanitized URLs.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: c640fbe3-6a62-4dbc-a304-8f5b15936e70
📒 Files selected for processing (2)
pkg/readiness/checks_test.gopkg/readiness/network.go
f0b656d to
8d4a5a1
Compare
Proxy URLs from the cluster Proxy CR may contain embedded credentials (user:password@host). These were forwarded unsanitized into the AgenticRun request, which is sent to an LLM provider. Strip the userinfo component before including proxy URLs in readiness output. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
8d4a5a1 to
09cdec7
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ankitathomas, jrangelramos The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Scheduling tests matching the |
|
/retest-required |
|
@jrangelramos: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| "http_proxy": NestedString(proxy.Object, "spec", "httpProxy"), | ||
| "https_proxy": NestedString(proxy.Object, "spec", "httpsProxy"), | ||
| "http_proxy": redactProxyURL(NestedString(proxy.Object, "spec", "httpProxy")), | ||
| "https_proxy": redactProxyURL(NestedString(proxy.Object, "spec", "httpsProxy")), |
There was a problem hiding this comment.
Seems like a good time to revisit pkg/readiness/network.go as a whole (CC @harche). It currently has:
-
An SDN warning, but SDN is gone since 4.17, so... no point in a 5.0 CVO looking around for it, right?
-
Embedding the Proxy config in the output, but:
agentic-skills$ git grep -i proxy origin/main -- cluster-update ...no hits...
So maybe we can just drop that whole check, like we dropped the CRD check in #1415?
5 participants
Summary
user:password@host). TheNetworkCheckreadiness collector forwarded these unsanitized into the AgenticRun request sent to the LLM provider.redactProxyURL()to strip the userinfo component vianet/url.Parsebefore including proxy URLs in readiness output. Falls back to[configured]if parsing fails (fail-closed).no_proxyis unchanged — it's a host list, not a URL.Test plan
TestNetworkCheck_ProxyCredentialRedaction: credentials stripped, no-credentials passthrough, empty string🤖 Generated with Claude Code
Summary by CodeRabbit
Bug Fixes
[configured], while empty and credential-free values remain unchanged.Tests