feat: Add secret masking to step logs

[chmouel]

Summary

Add secret masking for step stdout/stderr behind the enable-secret-masking feature flag.

How it works

• During pod creation, Tekton collects secret values referenced from step secretKeyRef, envFrom.secretRef, and secret volumes (including TaskSpec volumes).
• Collected values are de-duplicated and short values are skipped.
• The mask payload is prepared as base64-per-secret lines, then wrapped as base64(gzip(payload)) and passed to the init container via TEKTON_SECRET_MASK_DATA.
• The secret-mask-init subcommand decodes and uncompresses the env payload and writes a secret-mask file consumed by the entrypoint.
• The runner loads the secret-mask file and decodes each line back to secret bytes.
• A stream-safe masking writer redacts matching values to *** in stdout/stderr (and optional log files), handling split writes without leaking partial secret matches.

This commit wires the controller, init subcommand, runner integration, feature-flag surface, CRD/config plumbing, tests, and docs needed for this behavior.

Caveats

This is not 100% secure. The secret values are still present in the pod specification. Users with pods/get permission can still access them via kubectl get pod -o yaml.

This feature will not work on Windows nodes in this initial implementation.

However, this change provides meaningful improvements:

Aspect	Before	After
Visible in kubectl describe pod	Yes (in command)	No
Visible in process listings (ps aux)	Yes	No
Visible in kubectl get pod -o yaml	Yes	Yes

Demo

recording-20260204-17h35.mp4

---

Submitter Checklist

• Has Docs if any changes are user facing
• Has Tests included if any functionality added or changed
• pre-commit Passed
• Follows the commit message standard
• Meets the Tekton contributor standards
• Has a kind label
• Release notes block updated

Release Notes

Add feature-flag `enable-secret-masking` to enable masking of secrets in step logs. When enabled, secret values from environment variables and volume mounts are redacted with `***` in stdout/stderr. This prevents leaking secrets when viewing logs via `kubectl logs` or similar tools.

[chmouel]

/kind enhancement

[tekton-robot]

@chmouel: The label(s) kind/enhancement cannot be applied, because the repository doesn't have them.

Details

In response to this:

/kind enhancement

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[chmouel]

/kind feature

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please ask for approval from vdemeester after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[chmouel]

There is a limitation with this, secrets over 32kb (default go chunk size) it would not be able to be properly hidden...

[chmouel]

I have made a new implementation and detailled it in the PR, basically we increase the chunk size to the largest secrets, very large secrets (up to 1mb due of kube limitation) will slow down log streaming, this shows a warning when that happen....

I have as well optimized the implemntation by gzipping the passed content as one screen...

[vdemeester]

/retest