"minikube logs" exposes secrets in env

[alexec]

What Happened?

Hi,

The "minikube logs" command exposes secrets if they exist in your terminal environment. That is common of course. The minikube repository requests the logs to be pasted into issues. As a result I pasted by secrets into a Github Issue. Luckily, Github spotted them and notified me. I then had to revoke and delete tokens in 3 different systems, then the recent usage tokens to see if they’d be used, and then finally report this to my team.

This could have been a disaster.

It is common, even conventional, for secrets to appear in the env, so it not reasonable to say this is a user error.

In the short term, minikube repo issue template could warn users that they maybe pasting secrets.

In the medium term, “minikube logs” could consider either not printing env var, or redacting them.

Thank you,

Alex

Attach the log file

N/A

Operating System

No response

Driver

No response

[RA489]

/kind security

[spowelljr]

Hi @alexec, thanks for bringing this to our attention. I tried reproducing this but wasn't able to, could you tell me where in the logs the envs were output, also what driver were you using? As maybe the specific driver is outputting them.

I did

export CAT123=test
minikube start --driver=docker // and --driver=kvm2
minikube logs --file=logs.txt

Didn't find CAT123 in any of the logs.

Edit: I found the HyperKit driver is outputting all the envs in the terminal.