Skip to content

Add separate print commands for initial and validated configuration #13278

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

jmacd
Copy link
Contributor

@jmacd jmacd commented Jun 28, 2025

This PR introduces two distinct print commands to provide different views of the OpenTelemetry Collector configuration:

In my opinion, the print-initial-config command is dangerous because it prints a raw configuration object as map[string]string instead of printing the structured object with its correct configuration type. I would advocate to remove this feature instead of finishing the feature gate because it allows printing redacted strings.

The new command parses the configuration using the correct type, then prints it but does not validate it. It will be useful for a user to both debug validation problems and to see the exact configuration a component is using, by default, after configuration has been applied.

New/Modified Commands:

  • print-initial-config - (Modified) Shows the raw resolved configuration before validation (may contain sensitive values)
  • print-config - (New) Shows the validated configuration with component defaults applied and sensitive data redacted

Both commands support --format flag with yaml and json options:

  • print-config validates configuration through the full component pipeline and redacts sensitive data
  • print-initial-config shows raw configuration values without validation (behind feature gate)

Documented, tested.

@mx-psi
Copy link
Member

mx-psi commented Jun 30, 2025

In my opinion, the print-initial-config command is dangerous because it prints a raw configuration object as map[string]string instead of printing the structured object with its correct configuration type. I would advocate to remove this feature instead of finishing the feature gate because it allows printing redacted strings.

This is indeed one of the blockers for stabilizing the feature gate, see #12369, cc @VihasMakwana

@VihasMakwana
Copy link
Contributor

VihasMakwana commented Jun 30, 2025

In my opinion, the print-initial-config command is dangerous because it prints a raw configuration object as map[string]string instead of printing the structured object with its correct configuration type. I would advocate to remove this feature instead of finishing the feature gate because it allows printing redacted strings.

This is indeed one of the blockers for stabilizing the feature gate, see #12369, cc @VihasMakwana

Yeah. I was working on opening up a documentation PR to highlight the potential risk of that command. But I think we should discuss the future of the feature gate before proceeding.

I believe @jmacd's new command extends print-initial-config's functionality and takes care of the security risk.
If we all agree, we can remove the print-initial-config command citing the risk.

@jmacd
Copy link
Contributor Author

jmacd commented Jul 1, 2025

I would like to propose adding a single command (print-config) which can support several options.
(a) raw (a.k.a. "initial", less dangerous but can reveal top-level secrets I think)
(b) redacted (what I did, reveals defaults and overrides)
(c) unredacted (most dangerous, reveals everything)

@mx-psi
Copy link
Member

mx-psi commented Jul 2, 2025

I would like to propose adding a single command (print-config) which can support several options. (a) raw (a.k.a. "initial", less dangerous but can reveal top-level secrets I think) (b) redacted (what I did, reveals defaults and overrides) (c) unredacted (most dangerous, reveals everything)

That sounds good. No strong opinion on print-config vs print-initial-config so long as we do what the subcommand says 😸

@VihasMakwana
Copy link
Contributor

@jmacd sounds good!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants