[8.17](backport #6109) Make redaction of common keys in diagnostics case insensitive

changelog/fragments/1732184289-redact-case-insensitive.yaml

@@ -0,0 +1,32 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: bug-fix
+
+# Change summary; a 80ish characters long description of the change.
+summary: Make redaction of common keys in diagnostics case insensitive
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+#description:
+
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: elastic-agent
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+#pr: https://github.com/owner/repo/1234
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+#issue: https://github.com/owner/repo/1234

internal/pkg/diagnostics/diagnostics.go

@@ -393,6 +393,7 @@ func redactKey(k string) bool {
 		return false
 	}
 
+	k = strings.ToLower(k)
 	return strings.Contains(k, "certificate") ||
 		strings.Contains(k, "passphrase") ||
 		strings.Contains(k, "password") ||

internal/pkg/diagnostics/diagnostics_test.go

@@ -164,7 +164,33 @@ inputs:
 outputs:
     default:
         api_key: <REDACTED>
-        redactOtherKey: secretOutputValue
+        redactOtherKey: <REDACTED>
+        type: elasticsearch
+`,
+	}, {
+		name: "uppercase fields are redacted",
+		input: []byte(`id: test-policy
+inputs:
+  - type: test_input
+outputs:
+  default:
+    type: elasticsearch
+    api_key: secretKey
+    Certificate: secretCert
+    PassPhrase: secretPassphrase
+    PASSWORD: secretPassword
+    tOkEn: secretToken
+`),
+		expect: `id: test-policy
+inputs:
+    - type: test_input
+outputs:
+    default:
+        Certificate: <REDACTED>
+        PASSWORD: <REDACTED>
+        PassPhrase: <REDACTED>
+        api_key: <REDACTED>
+        tOkEn: <REDACTED>
         type: elasticsearch
 `,
 	}, {