From 62630dcee6847eee45e1fc448c330abeb27720d3 Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Sun, 28 Jun 2026 09:39:44 +0000
Subject: [PATCH] fix: redact kafka smoke payload output

---
 scripts/src/platform-infra-kafka.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/src/platform-infra-kafka.ts b/scripts/src/platform-infra-kafka.ts
index 0d1c1891..88445dc8 100644
--- a/scripts/src/platform-infra-kafka.ts
+++ b/scripts/src/platform-infra-kafka.ts
@@ -869,7 +869,7 @@ pod="$(kubectl -n ${target.namespace} get pod -l strimzi.io/cluster=${kafka.clus
 payload="unidesk-kafka-smoke-${target.id}-$(date +%s)-$$"
 printf '%s' "$payload" >"$tmp/payload.txt"
 if [ -n "$pod" ]; then
-  printf '%s\\n' "$payload" | kubectl -n ${target.namespace} exec -i "$pod" -- bin/kafka-console-producer.sh --bootstrap-server ${kafka.cluster.name}-kafka-bootstrap:${kafka.cluster.listeners.plain.port} --topic ${topic} --producer-property acks=all >"$tmp/produce.out" 2>"$tmp/produce.err"
+  printf '%s\\n' "$payload" | kubectl -n ${target.namespace} exec -i "$pod" -- bin/kafka-console-producer.sh --bootstrap-server ${kafka.cluster.name}-kafka-bootstrap:${kafka.cluster.listeners.plain.port} --topic ${topic} --command-property acks=all >"$tmp/produce.out" 2>"$tmp/produce.err"
   produce_rc=$?
   if [ "$produce_rc" -eq 0 ]; then
     timeout ${kafka.validation.timeoutSeconds} kubectl -n ${target.namespace} exec "$pod" -- bin/kafka-console-consumer.sh --bootstrap-server ${kafka.cluster.name}-kafka-bootstrap:${kafka.cluster.listeners.plain.port} --topic ${topic} --from-beginning --timeout-ms ${kafka.validation.timeoutSeconds * 1000} >"$tmp/consume.raw" 2>"$tmp/consume.err" || true
@@ -903,11 +903,16 @@ payload_obj = {
     "pod": pod or None,
     "message": {
         "sha256": hashlib.sha256(payload.encode()).hexdigest(),
+        "matched": consume_rc == 0,
         "valuesPrinted": False
     },
     "steps": {
         "produce": {"exitCode": produce_rc, "stdoutTail": text("produce.out"), "stderrTail": text("produce.err")},
-        "consume": {"exitCode": consume_rc, "stdoutTail": text("consume.out"), "stderrTail": text("consume.err")},
+        "consume": {
+            "exitCode": consume_rc,
+            "stdoutTail": "payload matched; stdout redacted" if consume_rc == 0 else "payload not found; stdout redacted",
+            "stderrTail": text("consume.err"),
+        },
     },
     "valuesPrinted": False,
 }