[FLINK-20055] Datadog API Key exposed in Flink JobManager logs

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.9.0
• Fix Version/s: 1.11.3, 1.12.1, 1.13.0
• Component/s: Runtime / Configuration, Runtime / Metrics
• Labels: pull-request-available
• Assignee: Florian Szabo
• Reporter: Florian Szabo
• Created: 09/Nov/20 07:56
• Updated: 02/Dec/20 22:50
• Resolved: 02/Dec/20 22:50

Description

When Flink is set up to report metrics to Datadog, the JobManager log containe the Datadog API key in plain format. In fact it shows up in two different places:

2020-08-03 09:03:19,400 INFO  org.apache.flink.configuration.GlobalConfiguration            - Loading configuration property: metrics.reporter.dghttp.apikey, <REDACTED-KEY>
...
2020-08-03 09:03:20,437 INFO  org.apache.flink.runtime.metrics.ReporterSetup                - Configuring dghttp with {apikey=<REDACTED-KEY>, tags=<...>,profile:<...>,region:<...>,env:<...>, class=org.apache.flink.metrics.datadog.DatadogHttpReporter}.

The expected behavior here should be that the API key in both places is hidden so that it does not end up in places where it should not be.

Issue Links

• links to: GitHub Pull Request #13995