Load sensitive config credentials via secrets/env variable
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 4k
- Forks
- 818
- Avg merge
- 1h 14m
- Merged PRs (30d)
- 1
Description
The burrow configuration requires SASL credentials (username + password). I don't want to put any credentials into my Kubernetes configmap.
Thus I am wondering if it Is possible to load parts of the configuration (e. g. SASL profile passwords) from environment variables, so that I don't need to put credentials into the configuration? This way I could mount a kubernetes secret as environment variable which then will be loaded on startup by burrow.
```toml
[tls.prd-tls-profile]
certfile="certificate.crt"
keyfile="keyfile.key"
cafile="rootcerts.crt"
noverify=false
[sasl.prd-sasl-profile]
username="myname"
password="sekrit"
handshake-first=false
```
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue identifies the TOML [sasl.] and [tls.] configuration sections and Kubernetes Secret environment variables, but names no repository file or test. Start by locating Burrow’s configuration-loading entry point; done means SASL credential values can be supplied through environment variables without putting them in the configmap, with the behavior verified for the shown profile.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- authentication, backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100