db connection string is cleartext in debug log

[Brant Knudson]

When I start up keystone-all with --debug it logs the config settings. The config setting for the database connection string is printed out:

(keystone-all): 2014-01-06 16:32:56,983 DEBUG cfg log_opt_values database.connection = mysql://root:rootpwd@127.0.0.1/keystone?charset=utf8

The database connection string will typically contain the user password, so this value should be masked (like admin_token).

This is a regression from Havana, which masked the db connection string.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/65167

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/65167
Committed: https://git.openstack.org/cgit/openstack/oslo-incubator/commit/?id=fa0f36fae9d572535d10a7e99297faed700ba584
Submitter: Jenkins
Branch: master

commit fa0f36fae9d572535d10a7e99297faed700ba584
Author: Brant Knudson <email address hidden>
Date: Mon Jan 6 16:42:29 2014 -0600

    Fix database connection string is secret

    The database connection string was not marked as secret, so it
    would be printed out in cleartext in the logs when config settings
    were logged.

    The database connection string typically contains the password
    that's used to connect to the database, so it should be marked as
    secret so that it doesn't get logged.

    Change-Id: If6e1026814262c961a4f22d90f546cec34831bc8
    Closes-Bug: #1266590

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/65713

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/65713
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=665cff12dddefb75c3e8fb6c810ef76fd545ea4f
Submitter: Jenkins
Branch: master

commit 665cff12dddefb75c3e8fb6c810ef76fd545ea4f
Author: Brant Knudson <email address hidden>
Date: Thu Jan 9 10:04:33 2014 -0600

    Merge db.sqlalchemy from oslo-incubator af5f710

    The db.sqlalchemy module was not recent with oslo-incubator.

     $ git checkout af5f71096c7bb83fe2f956588a9ec643b0d9a2f6
     $ python update.py --nodeps --base keystone \
       --dest-dir ../keystone --modules db.sqlalchemy

    The af5f710 oslo-incubator db.sqlalchemy contains a fix for the
    following problem, which caused a regression in Keystone:

    The database connection string was not marked as secret, so it
    would be printed out in cleartext in the logs when config settings
    were logged.

    The database connection string typically contains the password
    that's used to connect to the database, so it should be marked as
    secret so that it doesn't get logged.

    Change-Id: Ibdc63480a836646c5571a368f3c3a1d0c82d6aba
    Closes-Bug: #1266590

[John Griffith (john-griffith)]

Cinder has the secret=True setting in the conf options already, so the DNE Cinder.