Skip to content

Commit a0f0980

Browse files
committed
docs: condense CHANGELOG entries for env var override feature
Collapses the detailed per-fix bullet points into higher-level summary entries for the release notes.
1 parent 97e8f74 commit a0f0980

1 file changed

Lines changed: 3 additions & 8 deletions

File tree

CHANGELOG.md

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,9 @@
22

33
## Features
44

5-
- **Environment variable overrides for connection parameters**`AuthType`, `AccessId`, and `AccessKey` can now be overridden at runtime via the `AKEYLESS_AUTH_TYPE`, `AKEYLESS_ACCESS_ID`, and `AKEYLESS_ACCESS_KEY` environment variables, respectively, matching the existing `AKEYLESS_API_URL` override for the Akeyless API URL. This lets deployments control Akeyless connection details at the infrastructure/deployment level (e.g. process environment, secrets injection) instead of only via `manifest.json` or the Command portal.
6-
- Environment variable override values are trimmed of leading/trailing whitespace before use, so an incidental trailing newline (a common artifact of file-mounted/`envFrom` secret provisioning) no longer breaks the override.
7-
- An `AKEYLESS_AUTH_TYPE` override is now validated against the supported auth types before use; an unrecognized value fails fast with `InvalidClientConfigurationException` instead of silently skipping authentication and proceeding with an unauthenticated request.
8-
- The "Connecting to Akeyless at" debug log now reports the effective (post-override) URL rather than the pre-override configured value.
9-
- `Url`, `AuthType`, `AccessId`, and `AccessKey` are now required to be printable ASCII, whether the effective value came from an env var override or from Command's/`manifest.json`'s configuration — a value containing anything else (an embedded newline, ANSI escape sequence, Unicode line/paragraph separator, bidirectional-override or zero-width character, etc.) is rejected with `InvalidClientConfigurationException` instead of being passed through. None of these parameters are legitimately anything but printable ASCII, and letting a non-ASCII value through risked forging extra lines or spoofed rendering in the log messages that echo the resolved value. This check runs both where the configured value is first read (before `BuildAkeylessConfiguration`'s own debug logging echoes it) and again on the final resolved value in `InitClient` (which may instead be an env var override), so a malicious/malformed value can't reach either log statement unvalidated.
10-
- A failed Akeyless authentication attempt (`ApiException`) now logs the `AccessId` that was used, matching the existing success/empty-token log lines — previously this was the one authentication-failure path with no record of which identity (configured or env-overridden) the failed attempt used.
11-
- The `ApiException` catch in `InitClient` no longer passes the exception object itself to the logger — only the HTTP status code and `AccessId` are logged. Passing the exception object defeated the log call's own stated intent to exclude `ex.Message` (which may echo back the raw Akeyless response body, including credentials), since most logging providers render an attached exception's `Message`/`ToString()` regardless of the message template.
12-
- Rejecting a non-printable/non-ASCII `Url`/`AuthType`/`AccessId`/`AccessKey` now logs an error (naming the parameter, never the value) before throwing, matching every other validation failure in the provider — previously this was the one validation-throw site with no corresponding log entry, leaving no audit trail that a log-injection/spoofing attempt was rejected.
5+
- **Environment variable overrides for connection parameters**`AuthType`, `AccessId`, and `AccessKey` can now be overridden at runtime via the `AKEYLESS_AUTH_TYPE`, `AKEYLESS_ACCESS_ID`, and `AKEYLESS_ACCESS_KEY` environment variables, matching the existing `AKEYLESS_API_URL` override. This lets deployments control Akeyless connection details at the infrastructure level instead of only via `manifest.json` or the Command portal.
6+
- Environment variable overrides are trimmed of leading/trailing whitespace before use.
7+
- Hardened validation and logging around connection parameters and authentication failures.
138

149
# v1.0.0
1510

0 commit comments

Comments
 (0)