SDKQE-3975: carry Capella v4 API key credentials through fit-cli - #17
Open
emilienbev wants to merge 2 commits into
Open
SDKQE-3975: carry Capella v4 API key credentials through fit-cli#17emilienbev wants to merge 2 commits into
emilienbev wants to merge 2 commits into
Conversation
programmatix
approved these changes
Aug 14, 2026
- Resolve a v4 organization API key, secret, and v4 endpoint per Capella environment, from environments.json5 and the same AWS secret, with personal overrides via config, CAPELLA_API_KEY / CAPELLA_API_SECRET, or --capella-api-key / --capella-api-secret - Forward CAPELLA_V4_ENDPOINT, CAPELLA_API_KEY, and CAPELLA_API_SECRET to the remote box so cbdinocluster init --auto enables the cloud deployer, which now requires the API secret - Keep the v2 username/password: custom image deploys, server version changes, and columnar operations still need them
- CodeQL reported clear-text logging of the API key at the prompt replay log sites in src/util/non-fit/replay.ts. - Use a masked password prompt for the API key and do not put the saved key in the prompt message. The replay log masks password prompts, so neither the message nor the answer shows the key. - A blank answer keeps the saved key, the same as the API secret. - Add capella.apiKey to SECRET_FIELDS so the init --auto resolution log masks it too.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cbdinocluster now authenticates to Capella with a v4 organization API key.
init --autodisables the cloud deployer when the API secret is empty, and the later health check fails with a misleading message. fit-cli only carried v2 credentials, so this change adds the v4 values on every credential surface.CAPELLA_API_KEY/CAPELLA_API_SECRET, or--capella-api-key/--capella-api-secret.CAPELLA_V4_ENDPOINT,CAPELLA_API_KEY, andCAPELLA_API_SECRETto the remote box socbdinocluster init --autoenables the cloud deployer.Verified with
bun run typecheckandbun run test(894 pass). Lint failures are pre-existing on main; this change adds none. Not verified against live Capella.Note for reviewers: the AWS secrets
fit-cli/capella/{prod,dev,stage}needapiKeyandapiSecretentries before this can work, and the stage v4 endpoint is derived from the dev naming pattern and still needs confirmation.