posit-dev / posit-dev/team-operator
Ehance team-operator to load Connect Encryption key from AWS Secrets Manager
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 10
- Forks
- 1
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 4
Description
We encountered a security blocker when working with a customer
The customer did not want PTD deployments to have the encryption key exposed in the config map mounted as a file in the connect server pods.
This document has a proposal we made to the customer to mount the secret from AWS Secrets Manager into memory in the pod rather than the filesystem (an environment variable).
https://docs.google.com/document/d/1P0g1G02ePeTADnwY0GS8vZmOzQwn6HM2F4r4paIzGnQ/edit?tab=t.0
Slack discussion here: https://positpbc.slack.com/archives/C08E2MQ9954/p1762344614578959
We need to be careful not to break any existing deployments when we make this enhancement. Indeed security has granted a temporary security exception and will ask us if this is complete in January 2026.
Migrated from rstudio/ptd#2539
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked customer proposal and Slack discussion, then trace how team-operator currently configures the Connect encryption key and deployments. Preserve existing deployments while supporting the proposed AWS Secrets Manager path, and confirm the key is available in pod memory rather than mounted as a file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go, kubernetes
- Domain
- cloud, devops, infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100