# Sensu Go token expansion and redaction

**URL:** <https://discourse.sensu.io/t/sensu-go-token-expansion-and-redaction/1643>\
**Category:** Sensu Go\
**Created:** [February 23, 2020, 9:28pm UTC](https://discourse.sensu.io/t/sensu-go-token-expansion-and-redaction/1643 "2020-02-23T21:28:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![KendallChenoweth](https://avatars.discourse-cdn.com/v4/letter/k/ecd19e/32.png) [@KendallChenoweth](https://discourse.sensu.io/u/KendallChenoweth)\
**Post date:** [February 23, 2020, 9:28pm UTC](https://discourse.sensu.io/t/sensu-go-token-expansion-and-redaction/1643/1 "2020-02-23T21:28:53Z")

</div>

I have two entity definitions (that actually point to the same entity). One with redacted labels and one without. Against both entities, I’m running two almost identical checks that use the redacted labels in the command. For each almost identical check, I implemented two versions using the ‘index .labels “ldap.password”’ and in the other I use “labels.ldap.password”.

All the checks that run against the entity where the labels are not redacted succeed. All the checks that run against the entity where the labels are redacted fail. Is there an issue with using a redacted label in the command line? If not, can you help me figure out what I’m doing wrong?

I’m running Sensu Go 5.17.2 backend server and agent.

**alex.yml**

```
type: Entity
api_version: core/v2
sensu_agent_version: 1.0.0
metadata:
  labels:
    hardware: "synology"
    ldap_server: "true"
    ldap_password: "3vr52000"
    ldap_port: "389"
    ldap_user: "'uid=root,cn=users,dc=alexandria,dc=cyberbears,dc=net'"
    ldap_base: "'dc=alexandria,dc=cyberbears,dc=net'"
    snmp_password: "public"
  name: alex.cyberbears.net
  namespace: default
spec:
  deregister: false
  deregistration: {}
  entity_class: proxy
  last_seen: 0
  redact: 
  system:
    network:
      interfaces: null

```

**alexandria.yml**

```
type: Entity
api_version: core/v2
sensu_agent_version: 1.0.0
metadata:
  labels:
    hardware: "synology"
    ldap_server: "true"
    ldap_password: "3vr52000"
    ldap_port: "389"
    ldap_user: "'uid=root,cn=users,dc=alexandria,dc=cyberbears,dc=net'"
    ldap_base: "'dc=alexandria,dc=cyberbears,dc=net'"
    snmp_password: "public"
  name: alexandria.cyberbears.net
  namespace: default
spec:
  deregister: false
  deregistration: {}
  entity_class: proxy
  last_seen: 0
  redact: 
  - snmp_password
  - ldap_password
  system:
    network:
      interfaces: null

```

**Entity Differences**

```
diff alex.yml alexandria.yml 
13c13
< name: alex.cyberbears.net
---
> name: alexandria.cyberbears.net
20a21,22
> - snmp_password
> - ldap_password

```

**ldap\_server1.yml**

```
type: CheckConfig
api_version: core/v2
metadata:
  name: ldap_server1
  namespace: default
spec:
  command: check_ldap -H {{ .name }} -b {{ index .labels "ldap_base" }} -D {{ index .labels "ldap_user" }} -3 -P {{ index .labels "ldap_password" }} -p {{ index .labels "ldap_port" | default 389 }}
  interval: 10
  proxy_requests:
    entity_attributes:
    - entity.entity_class == 'proxy'
    - entity.labels.ldap_server == 'true'
  publish: true
  subscriptions:
  - sensu-proxy
  runtime_assets:
  - base_nagios_plugins

```

**ldap\_server2.yml**

```
type: CheckConfig
api_version: core/v2
metadata:
  name: ldap_server2
  namespace: default
spec:
  command: check_ldap -H {{ .name }} -b {{ index .labels "ldap_base" }} -D {{ index .labels "ldap_user" }} -3 -P {{ .labels.ldap_password }} -p {{ index .labels "ldap_port" | default 389 }}
  interval: 10
  proxy_requests:
    entity_attributes:
    - entity.entity_class == 'proxy'
    - entity.labels.ldap_server == 'true'
  publish: true
  subscriptions:
  - sensu-proxy
  runtime_assets:
  - base_nagios_plugins

```

**synology\_status1.yml**

```
type: CheckConfig
api_version: core/v2
metadata:
  name: synology_status1
  namespace: default
spec:
  command: check_snmp_synology -2 {{ .labels.snmp_password }} -h {{ .name }} -v
  interval: 10
  proxy_requests:
    entity_attributes:
    - entity.entity_class == 'proxy'
    - entity.labels.hardware == 'synology'
  publish: true
  subscriptions:
  - sensu-proxy
  runtime_assets:
  - synology_plugins

```

**synology\_status2.yml**

```
type: CheckConfig
api_version: core/v2
metadata:
  name: synology_status2
  namespace: default
spec:
  command: check_snmp_synology -2 {{ index .labels "snmp_password" }} -h {{ .name }} -v
  interval: 10
  proxy_requests:
    entity_attributes:
    - entity.entity_class == 'proxy'
    - entity.labels.hardware == 'synology'
  publish: true
  subscriptions:
  - sensu-proxy
  runtime_assets:
  - synology_plugins
```

---

<div class="post-metadata">

**Author:** ![KendallChenoweth](https://avatars.discourse-cdn.com/v4/letter/k/ecd19e/32.png) [@KendallChenoweth](https://discourse.sensu.io/u/KendallChenoweth)\
**Post date:** [February 24, 2020, 3:19am UTC](https://discourse.sensu.io/t/sensu-go-token-expansion-and-redaction/1643/2 "2020-02-24T03:19:22Z")

</div>

I found [this](https://github.com/sensu/sensu-go/issues/2723) on sensu’s github; the posting is kind of old. Have there been any updates?

---

<div class="post-metadata">

**Author:** ![palourde](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/palourde/32/60_2.png) [@palourde](https://discourse.sensu.io/u/palourde)\
**Post date:** [February 25, 2020, 4:19pm UTC](https://discourse.sensu.io/t/sensu-go-token-expansion-and-redaction/1643/3 "2020-02-25T16:19:08Z")

</div>

Hi @KendallChenoweth,

We released secrets management ([guide](https://docs.sensu.io/sensu-go/latest/guides/secrets-management/) & [reference docs](https://docs.sensu.io/sensu-go/latest/reference/secrets/)) in 5.17 which solves this exact problem. Using token substitution & redaction with proxy entities is simply not possible with the current architecture.

Thanks