search

elixir-cloud-aai / cwl-WES

Trigger CWL workflows via GA4GH WES and TES
Apache License 2.0
16 stars 18 forks source link

Implement strategy to pass secrets during build time #64

Open uniqueg opened 6 years ago

uniqueg commented 6 years ago

Is your feature request related to a problem? Please describe. Currently there is no way of conveniently passing secrets (FTP, database, broker credentials...) to the service during build time. As credentials cannot be version controlled, this presents a serious vulnerability.

Describe the solution you'd like Research and implement possible solutions, possibly involving Kubernetes and/or Docker secrets.

Once in place, use strategy to pass secrets/credentials for:

Describe alternatives you've considered N/A

Additional context N/A

uniqueg commented 4 years ago

A strategy has been devised for Kubernetes/OpenShift deployment: default values are passed as in deployment/values.yaml during Helm installation. See separate instructions in Helm Kubernetes/OpenShift install documentation. The strategy has been implemented for both the database and the .netrc file required for accessing FTP storage. Implement analogously for broker. Compare with #63 and resolve together.