TNZ-97934: Redact api_password and TLS private key from JSON-serialized config

Add MarshalJSON to API and SwitchboardApiTLS so that lager's JSON
encoding of the config struct on validation failure (main.go:36)
emits [REDACTED] instead of plaintext secrets. Certificate and all
non-sensitive fields are preserved.

Also adds unit tests for the redaction logic and an integration test
that confirms the proxy binary does not leak the password or PEM
private key in its fatal log output when startup validation fails.

ai-assisted=yes

[TNZ-97934](https://vmw-jira.broadcom.net/browse/TNZ-97934)

Authored-by: Kim Bassett <kim.bassett@broadcom.com>

Made-with: Claude Code

Author: kimago

src/github.com/cloudfoundry-incubator/switchboard/cmd/proxy/main_test.go

@@ -356,6 +356,57 @@ var _ = Describe("Switchboard", func() {
 		healthcheckWaitDuration = 3 * proxyConfig.HealthcheckTimeout()
 	})
 
+	// TNZ-97934: validation failure must not leak api_password or TLS private key
+	Context("when config validation fails", func() {
+		It("does not log sensitive config values in the fatal error message", func() {
+			const sensitivePassword = "SENTINEL-api-password-must-not-appear-in-logs"
+
+			// Build a config that will fail validation (bad GaleraAgentTLS CA)
+			// while holding a distinctive password and a real TLS private key
+			failConfig := config.Config{
+				BindAddress: "127.0.0.1",
+				Proxy: config.Proxy{
+					Backends:                 backends,
+					HealthcheckTimeoutMillis: 500,
+					Port:                     proxyPort,
+				},
+				API: config.API{
+					AggregatorPort: switchboardAPIAggregatorPort,
+					Port:           switchboardAPIPort,
+					Username:       "username",
+					Password:       sensitivePassword,
+					TLS: config.SwitchboardApiTLS{
+						Enabled:     true,
+						Certificate: string(testing.CertificatePEM(testCert.Certificate[0])),
+						PrivateKey:  string(testing.PrivateKeyPEM(testCert.PrivateKey)),
+					},
+				},
+				HealthPort: switchboardHealthPort,
+				StaticDir:  staticDir,
+				GaleraAgentTLS: config.GaleraAgentTLS{
+					Enabled: true,
+					CA:      "not-a-valid-pem-certificate",
+				},
+				Metrics: config.Metrics{Port: metricsPort},
+			}
+
+			configYAML, err := yaml.Marshal(failConfig)
+			Expect(err).NotTo(HaveOccurred())
+
+			cmd := exec.Command(switchboardBinPath, fmt.Sprintf("-config=%s", string(configYAML)))
+			output, _ := cmd.CombinedOutput()
+
+			// Sanity check: bad CA triggers Validate() → logger.Fatal → non-zero exit
+			Expect(cmd.ProcessState.ExitCode()).NotTo(Equal(0))
+
+			outputStr := string(output)
+			Expect(outputStr).NotTo(ContainSubstring(sensitivePassword),
+				"api_password was leaked in validation-failure log output")
+			Expect(outputStr).NotTo(ContainSubstring("PRIVATE KEY"),
+				"TLS private key PEM was leaked in validation-failure log output")
+		})
+	})
+
 	Context("Non TLS for the API", func() {
 
 		When("apiConfig.TlS is provided", func() {

src/github.com/cloudfoundry-incubator/switchboard/config/config.go

@@ -3,6 +3,7 @@ package config
 import (
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -51,6 +52,17 @@ type SwitchboardApiTLS struct {
 	PrivateKey  string `yaml:"PrivateKey"`
 }
 
+func (t SwitchboardApiTLS) MarshalJSON() ([]byte, error) {
+	type shadow SwitchboardApiTLS
+	return json.Marshal(struct {
+		shadow
+		PrivateKey string `json:"PrivateKey"`
+	}{
+		shadow:     shadow(t),
+		PrivateKey: "[REDACTED]",
+	})
+}
+
 type Proxy struct {
 	Port                     uint      `yaml:"Port" validate:"nonzero"`
 	InactiveMysqlPort        uint      `yaml:"InactiveMysqlPort"`
@@ -69,6 +81,17 @@ type API struct {
 	TLS            SwitchboardApiTLS `yaml:"TLS"`
 }
 
+func (a API) MarshalJSON() ([]byte, error) {
+	type shadow API
+	return json.Marshal(struct {
+		shadow
+		Password string `json:"Password"`
+	}{
+		shadow:   shadow(a),
+		Password: "[REDACTED]",
+	})
+}
+
 type Backend struct {
 	Host           string `yaml:"Host" validate:"nonzero"`
 	Port           uint   `yaml:"Port" validate:"nonzero"`

src/github.com/cloudfoundry-incubator/switchboard/config/config_test.go

@@ -1,6 +1,7 @@
 package config_test
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"net/http"
@@ -407,6 +408,109 @@ var _ = Describe("Config", func() {
 		})
 	})
 
+	Describe("JSON serialization (credential redaction)", func() {
+		Describe("SwitchboardApiTLS", func() {
+			It("redacts PrivateKey and preserves other fields", func() {
+				tlsConfig := SwitchboardApiTLS{
+					Enabled:     true,
+					Certificate: "-----BEGIN CERTIFICATE-----\nsome-cert\n-----END CERTIFICATE-----",
+					PrivateKey:  "-----BEGIN FAKE PRIVATE KEY-----\nsuper-secret-key\n-----END FAKE PRIVATE KEY-----",
+				}
+
+				data, err := json.Marshal(tlsConfig)
+				Expect(err).NotTo(HaveOccurred())
+
+				var result map[string]interface{}
+				Expect(json.Unmarshal(data, &result)).To(Succeed())
+
+				Expect(result["PrivateKey"]).To(Equal("[REDACTED]"),
+					"PrivateKey must be redacted in JSON output")
+				Expect(result["Certificate"]).To(Equal(tlsConfig.Certificate),
+					"Certificate (public) must be preserved in JSON output")
+				Expect(result["Enabled"]).To(BeTrue(),
+					"Enabled flag must be preserved in JSON output")
+			})
+
+			It("redacts PrivateKey even when empty", func() {
+				tlsConfig := SwitchboardApiTLS{Enabled: false}
+
+				data, err := json.Marshal(tlsConfig)
+				Expect(err).NotTo(HaveOccurred())
+
+				var result map[string]interface{}
+				Expect(json.Unmarshal(data, &result)).To(Succeed())
+
+				Expect(result["PrivateKey"]).To(Equal("[REDACTED]"))
+			})
+		})
+
+		Describe("API", func() {
+			It("redacts Password and preserves other fields", func() {
+				apiConfig := API{
+					Port:           8080,
+					AggregatorPort: 8081,
+					Username:       "admin",
+					Password:       "super-secret-password",
+					ForceHttps:     true,
+					ProxyURIs:      []string{"proxy1", "proxy2"},
+				}
+
+				data, err := json.Marshal(apiConfig)
+				Expect(err).NotTo(HaveOccurred())
+
+				var result map[string]interface{}
+				Expect(json.Unmarshal(data, &result)).To(Succeed())
+
+				Expect(result["Password"]).To(Equal("[REDACTED]"),
+					"Password must be redacted in JSON output")
+				Expect(result["Username"]).To(Equal("admin"),
+					"Username must be preserved in JSON output")
+				Expect(result["Port"]).To(BeNumerically("==", 8080),
+					"Port must be preserved in JSON output")
+				Expect(result["ForceHttps"]).To(BeTrue(),
+					"ForceHttps must be preserved in JSON output")
+			})
+
+			It("also redacts the nested TLS PrivateKey", func() {
+				apiConfig := API{
+					Password: "secret-password",
+					TLS: SwitchboardApiTLS{
+						Enabled:     true,
+						Certificate: "some-cert",
+						PrivateKey:  "secret-private-key",
+					},
+				}
+
+				data, err := json.Marshal(apiConfig)
+				Expect(err).NotTo(HaveOccurred())
+
+				var result map[string]interface{}
+				Expect(json.Unmarshal(data, &result)).To(Succeed())
+
+				Expect(result["Password"]).To(Equal("[REDACTED]"))
+
+				tlsMap, ok := result["TLS"].(map[string]interface{})
+				Expect(ok).To(BeTrue())
+				Expect(tlsMap["PrivateKey"]).To(Equal("[REDACTED]"),
+					"TLS.PrivateKey must be redacted via nested MarshalJSON")
+				Expect(tlsMap["Certificate"]).To(Equal("some-cert"),
+					"TLS.Certificate must be preserved")
+			})
+
+			It("redacts Password even when empty", func() {
+				apiConfig := API{}
+
+				data, err := json.Marshal(apiConfig)
+				Expect(err).NotTo(HaveOccurred())
+
+				var result map[string]interface{}
+				Expect(json.Unmarshal(data, &result)).To(Succeed())
+
+				Expect(result["Password"]).To(Equal("[REDACTED]"))
+			})
+		})
+	})
+
 	Describe("Default values", func() {
 		It("preserves defaults when empty config values are provided", func() {
 			osArgs := []string{