Masking mac address in logs.

[Sachin4403]

We want to mask mac address octets in logs based on the regex configuration so that we will not presist PII information in logs.

[joe94]

@Sachin4403 Which services did you see this happening on?

[joe94]

@Sachin4403, after looking through some of our services and chatting with the team, we're finding that the best solution we can offer today is hunting down the different parts of the codebase where sensitive fields are logged and mask them. While this might be enough for you today, we wanted to be clear that we cannot guarantee that a later version of our services will not re-introduce the logging of sensitive data. This is because the process to verify this is very manual (code reviews during PRs). We wanted to give you that disclaimer before committing to make the changes

[Sachin4403]

Okay @joe94, This masking will be done based on configuration?

[joe94]

@Sachin4403, yes. Here's a sample issue I made xmidt-org/tr1d1um#220. It's a simple mask or not mask option. For triaging and debugging in our clusters, we would still want to keep our IDs unmasked so we can do filtering on them.

[joe94]

@Sachin4403 did my last comment above make sense? ☝🏼

[Sachin4403]

Yes @joe94.