You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "ido177 (via GitHub)" <gi...@apache.org> on 2025/09/22 11:06:52 UTC
[I] Secret Masker doesn't mask sensitive values in CLI [airflow]
ido177 opened a new issue, #55947:
URL: https://github.com/apache/airflow/issues/55947
### Apache Airflow version
3.0.6
### If "Other Airflow 2 version" selected, which one?
_No response_
### What happened?
While running `airflow config list` in cli, sensitive values are not being hidden
@ashb asked to raise another issue [here](https://github.com/apache/airflow/issues/54540#issuecomment-3192073258)
### What you think should happen instead?
All sensitive values should be masked with ***
### How to reproduce
Simply run command `airflow config list`
### Operating System
Debian GNU/Linux 12 (bookworm)
### Versions of Apache Airflow Providers
apache-airflow==3.0.4
apache-airflow-providers-google==17.1.0
apache-airflow-providers-mysql==6.3.3
apache-airflow-providers-slack==9.1.3
apache-airflow-providers-vertica==4.1.2
apache-airflow-providers-apache-livy==4.4.2
apache-airflow-providers-ssh==4.1.2
apache-airflow-providers-common-sql==1.27.4
apache-airflow-providers-cncf-kubernetes==10.6.0
apache-airflow-providers-hashicorp==4.3.2
apache-airflow-providers-standard==1.5.0
### Deployment
Official Apache Airflow Helm Chart
### Deployment details
We’re running Airflow in Kubernetes using both Celery and Local executors. Deploying from official chart 1.18.0.
### Anything else?
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secret Masker doesn't mask sensitive values in CLI [airflow]
Posted by "ido177 (via GitHub)" <gi...@apache.org>.
ido177 closed issue #55947: Secret Masker doesn't mask sensitive values in CLI
URL: https://github.com/apache/airflow/issues/55947
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secret Masker doesn't mask sensitive values in CLI [airflow]
Posted by "anishgirianish (via GitHub)" <gi...@apache.org>.
anishgirianish commented on issue #55947:
URL: https://github.com/apache/airflow/issues/55947#issuecomment-3692967651
Hi I would like to work on this , could you assign this issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secret Masker doesn't mask sensitive values in CLI [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #55947:
URL: https://github.com/apache/airflow/issues/55947#issuecomment-3398392366
Apparently - this has always been like this (generally anyone who can run `airflow config` can also see the values - so this is not a security issue, If someone takes it, there should be a discussion on devlist how we should treat "airflow config" values first and agree what to do.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secret Masker doesn't mask sensitive values in CLI [airflow]
Posted by "codesbyjit (via GitHub)" <gi...@apache.org>.
codesbyjit commented on issue #55947:
URL: https://github.com/apache/airflow/issues/55947#issuecomment-3530997223
Hi! I'd like to work on this.
Before starting the implementation, could you please clarify:
- Which config fields should be considered sensitive?
- Should we mask them always, or only when running `airflow config list`?
- Should masking follow the same rules as SecretBackend masking?
Once clarified, I’ll start working on the PR. Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secret Masker doesn't mask sensitive values in CLI [airflow]
Posted by "ashb (via GitHub)" <gi...@apache.org>.
ashb commented on issue #55947:
URL: https://github.com/apache/airflow/issues/55947#issuecomment-3531769682
Which configs are sensitive is already defing in AirflowConfig parser class.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Secret Masker doesn't mask sensitive values in CLI [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on issue #55947:
URL: https://github.com/apache/airflow/issues/55947#issuecomment-4326908677
This will be moved to airflowctl soon and won't be needed as API already masking values in default.
On the otherhand, we have show values for connection and only way to see the connection without mask is Airflow CLI, maybe we need to have two config flavour one airflowctl and one to read configs from admin side as it is useful for debugging
For this issue we don't need to work on masking additionally as airflowctl will provide that layer auto, my suggestion would be closing this. My on the other hand section still holds but maybe we discuss that in migration PR or new issue specific for that
More info
https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=382175838
We will start merging PRs and work already started
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org