datastax / pulsar-helm-chart

Apache Pulsar Helm chart
Apache License 2.0
47 stars 38 forks source link

Pass Java Keystore password by file name; prevent keystore password from leaking in logs #173

Closed michaeljmarshall closed 2 years ago

michaeljmarshall commented 2 years ago

Fixes #164.

Instead of storing the password in an env var, now we write it to a file and pass it to zookeeper by file name. I used the previous mechanism to create a unique password in each pod and then write that password to a file. This solution is backwards compatible.

Alternatively, I could have made it possible to configure this password for each component. I think that would end up being more effort than it's worth, and it would have meant that the secret was the same for all pods in a group.