From 438c95892f893886864fbcf41fa776cb677b126d Mon Sep 17 00:00:00 2001 From: Santiago Date: Wed, 24 Aug 2022 20:52:31 +0000 Subject: [PATCH] alerting: redact alertmanagers in scheduler logs (#54183) --- pkg/services/ngalert/schedule/schedule.go | 26 +++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/pkg/services/ngalert/schedule/schedule.go b/pkg/services/ngalert/schedule/schedule.go index 851d57b2b04..a4af49c1708 100644 --- a/pkg/services/ngalert/schedule/schedule.go +++ b/pkg/services/ngalert/schedule/schedule.go @@ -226,25 +226,39 @@ func (sch *schedule) SyncAndApplyConfigFromDatabase() error { continue } + // Avoid logging sensitive data + var redactedAMs []string + for _, am := range cfg.Alertmanagers { + parsedAM, err := url.Parse(am) + if err != nil { + sch.log.Error("failed to parse alertmanager string", + "org", cfg.OrgID, + "err", err) + continue + } + redactedAMs = append(redactedAMs, parsedAM.Redacted()) + } + // We have a running sender, check if we need to apply a new config. + amHash := cfg.AsSHA256() if ok { - if sch.sendersCfgHash[cfg.OrgID] == cfg.AsSHA256() { - sch.log.Debug("sender configuration is the same as the one running, no-op", "org", cfg.OrgID, "alertmanagers", cfg.Alertmanagers) + if sch.sendersCfgHash[cfg.OrgID] == amHash { + sch.log.Debug("sender configuration is the same as the one running, no-op", "org", cfg.OrgID, "alertmanagers", redactedAMs) continue } - sch.log.Debug("applying new configuration to sender", "org", cfg.OrgID, "alertmanagers", cfg.Alertmanagers) + sch.log.Debug("applying new configuration to sender", "org", cfg.OrgID, "alertmanagers", redactedAMs) err := existing.ApplyConfig(cfg) if err != nil { sch.log.Error("failed to apply configuration", "err", err, "org", cfg.OrgID) continue } - sch.sendersCfgHash[cfg.OrgID] = cfg.AsSHA256() + sch.sendersCfgHash[cfg.OrgID] = amHash continue } // No sender and have Alertmanager(s) to send to - start a new one. - sch.log.Info("creating new sender for the external alertmanagers", "org", cfg.OrgID, "alertmanagers", cfg.Alertmanagers) + sch.log.Info("creating new sender for the external alertmanagers", "org", cfg.OrgID, "alertmanagers", redactedAMs) s, err := sender.New(sch.metrics) if err != nil { sch.log.Error("unable to start the sender", "err", err, "org", cfg.OrgID) @@ -260,7 +274,7 @@ func (sch *schedule) SyncAndApplyConfigFromDatabase() error { continue } - sch.sendersCfgHash[cfg.OrgID] = cfg.AsSHA256() + sch.sendersCfgHash[cfg.OrgID] = amHash } sendersToStop := map[int64]*sender.Sender{}