Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Statping chart stores database password in ConfigMap, not in secret #4

Open
florian-besser opened this issue Jan 19, 2024 · 0 comments

Comments

@florian-besser
Copy link

As part of applying this helm chart the configMap statping is created. This configMap may contain:

apiVersion: v1
data:
  DB_CONN: postgres
  DB_DATABASE: statping
  DB_HOST: CENSORED
  DB_PASS: CENSORED
  DB_PORT: "5432"
  DB_USER: statping
  DEBUG: "1"
  DISABLE_COLORS: "true"
  PORT: "8080"
  POSTGRES_SSLMODE: require
  READ_ONLY: "false"
kind: ConfigMap
metadata:
  annotations:
    meta.helm.sh/release-name: statping
    meta.helm.sh/release-namespace: alm
  creationTimestamp: "2024-01-19T04:10:45Z"
  labels:
    app.kubernetes.io/managed-by: Helm
  name: statping
  namespace: alm
  resourceVersion: "202811663"
  uid: 591735bc-3fa7-47f0-95f6-72462c848995

(fetched using kubectl get cm -n alm statping -o yaml

I have censored the hostname and password in the output.

Passwords and other sensitive information should be stored in secrets, as there may be people running around the cluster with privileges to read ConfigMaps (for easy maintenance, changing configs) but they can't read secrets (to keep the secrets actually secret!)

I can provide a PR if this is a desirable change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant