search

operate-first / curator

Metering project for OpenShift
MIT License
2 stars 8 forks source link

Store database password in Secret #69

Closed leihchen closed 2 years ago

leihchen commented 3 years ago

Description: https://github.com/operate-first/curator/blob/01503fcc88d578fb0b9da7a9f00d1e332bd0de38/Documentation/config/config.env#L8 The database password is passed as plain text in configMap. Considering using Secret?

skanthed commented 3 years ago

We are already passing all environment variables to the config map generator and that all are converted into secrets. Once we have the database table we will make sure over there to keep the type.

leihchen commented 2 years ago

This is still an unsolved issue. Database password is visible as plaintext in configMap: https://console-openshift-console.apps.smaug.na.operate-first.cloud/k8s/ns/koku-metrics-operator/configmaps/backup-config-kffbgh9f46.

larsks commented 2 years ago

@leihchen Can you clarify what the problem is? The contents of secrets and configmaps in kubernetes (or openshift) are always visible as plaintext. If you have access to the namespace that contains the data, you can see it.

If the password is being stored in plaintext in this repository that is a problem, but otherwise it sounds like things are behaving as designed.

leihchen commented 2 years ago

@larsks I was suggesting using Secret to store database password instead of configMap.

larsks commented 2 years ago

That's fine, as long as you realize that secrets also store information as plain text. By default there's no functional difference between the two. The advantage to using a secret is primarily informational (it tells you, "this information should be treated carefully"), and because by having a separate resource type you can apply difference access policies, etc. to them. But simply moving from a configmap to a secret doesn't really get you anything in terms of security.

leihchen commented 2 years ago

OK. Thank you!