search

rootfs / node-fencing

Apache License 2.0
5 stars 6 forks source link

Adding "fetch password from secret" script mechanism #47

Closed bronhaim closed 6 years ago

bronhaim commented 6 years ago

This patch adds simple go process that runs as part of the agent pod with service account that allows it to get secrets object from apiserver. This is done to avoid passing plain-text password as part of the request. To enable encryption in etcd when secret is stored, EncryptionConfig should be set properly (https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/)

bronhaim commented 6 years ago

I added it intentionally, just to avoid issues when building the agent image without the script. But you are totally right. "make" builds it anyway and put the output under the desired directory. make images runs the make before, so I guess its fine. I'll remove it from the commit