Add datapolicy tags to staging/src/k8s.io/cri-api/

[serathius]

/kind feature

What this PR does / why we need it:
This PR adds "datapolicy" tags to golang structures as described in Kubernetes system components logs sanitization KEP. Those tags will be used by for ensuring this data will not be written to logs by Kubernetes system components.

List of datapolicy tags available:

• security-key - for TLS certificate keys. Keywords: key, cert, pem
• token - for HTTP authorization tokens. Keywords: token, secret, header, auth
• password - anything passwordlike. Keywords: password

Special notes for your reviewer:

Due to size of Kubernetes codebase first iteration of tagging was done based on greping for particular keyword. Please ensure that tagged fields do contain type of sensitive data that matches their tag. Feel free to suggest any additional places that you think should be tagged.

Does this PR introduce a user-facing change?:
No

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

- [KEP]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/1753-logs-sanitization

/cc @PurelyApplied
/sig instrumentation security
/priority important-soon
/milestone v1.20

[k8s-ci-robot]

@serathius: GitHub didn't allow me to request PR reviews from the following users: PurelyApplied.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/kind feature

What this PR does / why we need it:
This PR adds "datapolicy" tags to golang structures as described in Kubernetes system components logs sanitization KEP. Those tags will be used by for ensuring this data will not be written to logs written by Kubernetes system components.

List of datapolicy tags available:

• security-key - for TLS certificate keys. Keywords: key, cert, pem
• token - for HTTP authorization tokens. Keywords: token, secret, header, auth
• password - anything passwordlike. Keywords: password

Special notes for your reviewer:

Due to size of Kubernetes codebase first iteration of tagging was done based on greping for particular keyword. Please ensure that tagged fields do contain type of sensitive data that matches their tag. Feel free to suggest any additional places that you think should be tagged.

Does this PR introduce a user-facing change?:
No

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

- [KEP]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/1753-logs-sanitization

/cc @PurelyApplied
/sig instrumentation security
/priority important-soon
/milestone v1.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: serathius
To complete the pull request process, please assign derekwaynecarr after the PR has been reviewed.
You can assign the PR to them by writing /assign @derekwaynecarr in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• staging/src/k8s.io/cri-api/pkg/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[serathius]

/assign @derekwaynecarr

[k8s-ci-robot]

@serathius: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
pull-kubernetes-verify	4950d3b	link	/test pull-kubernetes-verify

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[derekwaynecarr]

I don't think it makes sense to add these to the generated go files because this is generated from api.proto.

Have you done this with any other proto based interface yet?

/cc @mrunalp

[derekwaynecarr]

/assign @mrunalp @mikebrow as part of CRI GA tracking.

[mrunalp]

@serathius Did you check if there is a way to pass these down from the proto file?

[mikebrow]

can we link to the datapolicy kep here and/or provide a brief explanation of any client and server processing requirements? I believe the expectation here is these fields if output to a log would cause the log entry to be filterable by some datapolicy filtering tool. What's not clear is if there is any new expectation (or not) that container runtime integrations must apply a filter/mask for these fields (remove them from the logs replace with xxx etc.). I'd have to check to make sure but I believe I remember seeing commits over time that removed these fields from the logs.

[PurelyApplied]

@mrunalp Not to speak for @serathius, but there's an old protobuf Issue#52 about adding the ability to export field tags from protobuf. The long and short seems to be that protobuf doesn't want it to be possible by default.

People have made plugins for it, but being unfamiliar with the nitty gritty of generating from api.proto, it's unclear to me how tractable it would be to try to add a plugin into the build.

[serathius]

/milestone clear

[mrunalp]

https://blog.golang.org/protobuf-apiv2 describes FieldOptions to achieve something similar.

[ehashman]

I agree with the above fwiw; I think if we add the tags directly to the generated file, they'll just get overwritten.

[dashpole]

/assign @ehashman
/triage accepted

[ehashman]

/hold

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale