From db2dfaae87bc42e58531bb7db8e332b1f7f68fd9 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 30 Apr 2026 13:56:54 +0300 Subject: [PATCH] =?UTF-8?q?tower=200.61.12=20=E2=80=94=20silent=20connect?= =?UTF-8?q?=20+=20no=20kubeconfig=20leak?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Customer running the connect URL was getting the entire k3s install transcript scrolled to their terminal — including the base64-encoded kubeconfig (cluster-admin certs visible in scrollback). Two problems: 1. UX: violates "Tower silent in the background" platform principle. 2. Security: cluster-admin material visible to anyone shoulder-surfing or screen-sharing. wrapQuiet() in connect_token.go now wraps bootstrap + trailer: - all output → /var/log/odoosky-connect.log (operator-readable) - ONE friendly line to terminal at start ("Connecting…") - ONE outcome line at end (✓ success / ⚠ failure) - on non-zero exit: dump last 30 log lines so customer isn't staring at a silent terminal Kubeconfig is already tee'd to /tmp/odoosky-kubeconfig.yaml by the bootstrap, so the trailer reads it from disk — never needs stdout. --- values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/values.yaml b/values.yaml index 486998b..af4b050 100644 --- a/values.yaml +++ b/values.yaml @@ -9,7 +9,7 @@ backend: # so every cluster that runs Tower needs the same imagePullSecret # provisioned out-of-band (until cluster-platform-v3 owns it). repository: registry.odoosky.cloud/odoosky/docker-mirror/tower - tag: "0.61.11" + tag: "0.61.12" pullPolicy: IfNotPresent imagePullSecrets: - name: docker-mirror-pull