Guidiance on feat(mojaloop/3082): Utilise externalised secrets for password management

[mdebarros]

Request Summary:

As part of story 'feat(mojaloop/#3082): Utilise externalised secrets for password management', we are externalising all password management (i.e. secrets) by adding support in the Mojaloop Helm Charts to reference an externalised secret definition within Kubernetes.

We have two approaches here:

1. Support both clear password configuration (as-is) and externalised secret reference (to-be) with this overriding the clear password config. This is generally the standard approach taken by the wider Helm community.
2. ONLY support externalised secret reference (to-be) with there being NO option to set a clear password. This would mean that deployers of Mojaloop would HAVE to create prior to deploying Mojaloop or utilise an existing secret. The idea being here that we would FORCE Mojaloop deployers to ALWAYS adhere to best practices.

Request Details:

• Deadline: 2023-02-15
• Impact (Teams): Possiby extra effort required depending on the decision.
• Impact (Components): Possiby extra effort required depending on the decision.

A decision on one of the two approaches.

Artifacts:

• https://github.com/mojaloop/project/issues/2720
• https://github.com/mojaloop/quoting-service/pull/203#issuecomment-626962538

Dependencies:

• https://github.com/mojaloop/project/issues/3082

Accountability:

• Owner: @mdebarros
• Raised By: @mdebarros

Decision(s):

Decision by DA on 2023-02-15

• Support both clear password configuration (as-is) and externalised secret reference (to-be) with this overriding the clear password config.
• All clear-type passwords in the Mojaloop charts should be "cleared" and set to an empty string

Approved By: All attending DA members on DA Meeting held on 2023-02-15

Details

• [ ] Actual decision made as a result of discussion

Follow-up:

- [ ] Actions to implement the decisions

[mdebarros]

Decision by DA on 2023-02-15

• Support both clear password configuration (as-is) and externalised secret reference (to-be) with this overriding the clear password config. This is generally the standard approach taken by the wider Helm community.
• All clear-type passwords in the Mojaloop charts should be "cleared" and set to an empty string