[ti-chi-bot]

This is an automated cherry-pick of #6790

What problem does this PR solve?

Issue Number: close #6789

The new-architecture server currently disables log redaction when [security] redact-info-log is omitted. Values passed to redaction-aware log helpers can appear in logs by default.

What is changed and how it works?

Resolve an unset redact-info-log to ON in the new-architecture server. Explicit OFF, ON, and MARKER settings keep their existing behavior. The old-architecture TiFlow startup path is unchanged. Update the server tests and the configuration comment to match. The existing log_redaction integration case now starts without the setting and verifies the effective ON mode and masked DML values.

Check List

Tests

• Unit test: GOTOOLCHAIN=auto go test ./cmd/cdc/server -count=1
• Integration test: log_redaction (MySQL light CI group; pending on this commit)
• Build: GOTOOLCHAIN=auto make cdc

Questions

Will it cause performance regression or break compatibility?

Redaction-aware log values are now masked by default; explicit OFF restores the previous log output. No replication data path changes. The added redaction work is limited to log formatting.

Do you need to update user documentation, design documentation or monitoring documentation?

The user-facing server configuration reference should state the new default. No design or monitoring documentation changes are needed in this repository.

Release note

Enable log redaction by default for new-architecture TiCDC servers when `redact-info-log` is not configured.

Summary by CodeRabbit

• Bug Fixes
  • Sensitive information in logs is now redacted by default when the redaction setting is unset on the new-architecture server. Explicitly configured settings continue to apply, so existing configurations retain their behavior. This default is also reflected when the server starts without a redaction setting.

[ti-chi-bot]

@asddongmen This PR has conflicts, I have hold it.
Please resolve them or ask others to resolve them, then comment /unhold to remove the hold label.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 20 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1e5bf663-4d55-4b8a-b65f-9fbaf8fd27ce

Commits

Reviewing files that changed from the base of the PR and between 3cdc95e and 4ee1f4d.

Files selected for processing: 4

• cmd/cdc/server/server.go
• cmd/cdc/server/server_redact_test.go
• pkg/security/credential.go
• tests/integration_tests/log_redaction/run.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[ti-chi-bot]

@ti-chi-bot: ## If you want to know how to resolve it, please read the guide in TiDB Dev Guide.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lidezhu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [lidezhu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment