search

kapicorp / kapitan

Generic templated configuration management for Kubernetes, Terraform and other things
https://kapitan.dev
Apache License 2.0
1.83k stars 199 forks source link

Search for plaintext secrets in inventory #73

Closed adrianchifor closed 5 years ago

adrianchifor commented 6 years ago

Maybe check the keys containing

*key*  *pass*  *token*  *secret*  *pin*  *security*  *crypto*

and check the value entropy.

We should ignore gpg references.

Can be integrated as part of kapitan lint

uberspot commented 5 years ago

For reference: https://github.com/Yelp/detect-secrets/ and https://github.com/dxa4481/truffleHog/ seem to already do the same and more advanced checks and can be added to CI/CD pipelines. I'd recommend closing the issue.