Option to project secrets as files
- Dominant language
- Mustache
- Stars
- 55
- Forks
- 68
- PR merge metrics
- No merged PRs in 30d
Description
**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
Several security benchmarking tools look for patterns like this.
``` yaml
- name: "ADMINHASH"
valueFrom:
secretKeyRef:
name: somename
key: adminHash
```
And mark a finding due to policies such as:
- https://avd.aquasec.com/compliance/kubernetes/cis-kubernetes-benchmarks-v1.23-1.23/5.4.1/
- https://www.tenable.com/policies/cloud-security/AC_K8S_0051
- https://www.tenable.com/audits/items/DISA_STIG_Kubernetes_v1r11.audit:fdb2906c002a74a6f822c62bef0d8ed0
**Describe the solution you'd like**
A clear and concise description of what you want to happen.
It would be nice if there was an option/toggle such as.
`secretsAsFiles: true`
That when enabled removed all usage such as
``` yaml
- name: "ADMINHASH"
valueFrom:
secretKeyRef:
name: somename
key: adminHash
```
This would be off/disabled by default to preserve existing behavior and allow users to opt in if they want it.
I'm willing to take on the PR to do this but may need some guidance on the preferred way to wire in the values as files.
From looking at the manifests the following properties would need to be provided through files.
- COUCHDB_ERLANG_COOKIE
- COUCHDB_SECRET
- COUCHDB_PASSWORD
- COUCHDB_USER
- ADMINUSERNAME
- ADMINHASH
Contributor guide
No contributing guide indexed for this repository
Research direction
Locate the chart manifests that define COUCHDB_ERLANG_COOKIE, COUCHDB_SECRET, COUCHDB_PASSWORD, COUCHDB_USER, ADMINUSERNAME, and ADMINHASH, then trace how their Helm values are rendered. The option should preserve current secretKeyRef behavior by default and render the listed values as files when enabled; verify the rendered manifests for both settings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100