Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: apisix enable_encrypt_fields should support plugin fields that are deeply situated, array elements, etc. #11099

Open
shreemaan-abhishek opened this issue Mar 28, 2024 · 1 comment

Comments

@shreemaan-abhishek
Copy link
Contributor

shreemaan-abhishek commented Mar 28, 2024

Description

Current Situation:

APISIX enable_encrypt_fields only supports sensitive fields situated within two levels of depth. ref:

-- we only support two levels

and it would not be possilbe to specify fields like kafka logger's brokers.sasl_config.password in any of the following ways even if fields from multiple depth levels were supported because brokers is of type array.

encrypt_fields = { "brokers.sasl_config.password" }
-- or
encrypt_fields = { "brokers.foreach.sasl_config.password" }
-- or
encrypt_fields = { "brokers.all.sasl_config.password" }
-- none of the above options work 🤷🏻‍♂️

Expected Situation:

There should be a mechanism to include plugin fields for encryption regardless of their nature. Due to this limitation it's not possible to include fields like kafka-logger's brokers.sasl_config.password, aws-lambda's secretKey.

This limitation was found during the implementation of #11095

@starsz
Copy link
Contributor

starsz commented Mar 28, 2024

Could we check the type of the plugin fields, if it's an array, then we encrypt the values in this array.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: 📋 Backlog
Development

No branches or pull requests

2 participants