Remove hard coded secrets

REBELinBLUE · Dec 3, 2019 · 3fb2a94 · 3fb2a94
1 parent 76e0b34
commit 3fb2a94
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 14 deletions.
diff --git a/deployments/infra/traefik-forward-auth/traefik-forward-auth.yaml b/deployments/infra/traefik-forward-auth/traefik-forward-auth.yaml
@@ -1,16 +1,4 @@
-kind: Secret
-apiVersion: v1
-metadata:
-  name: traefik-forward-auth-secrets
-  namespace: infra
-  labels:
-    name: traefik
-type: Opaque
-data:
-  CLIENT_SECRET: MC1oeUpXVW90S0VjN2xUcnIwUUpvYmc5
-  SECRET: SkxvQUYyM3JabVRyQWJUZg==
 ---
-kind: Deployment
 apiVersion: apps/v1
 metadata:
   name: traefik-forward-auth
@@ -40,7 +28,10 @@ spec:
             - name: OIDC_ISSUER
               value: https://accounts.google.com
             - name: CLIENT_ID
-              value: 790180635443-4kkbqimheq81o2p612t3itrl8bkcvthe.apps.googleusercontent.com
+              valueFrom:
+                secretKeyRef:
+                  name: traefik-forward-auth-secrets
+                  key: CLIENT_ID
             - name: CLIENT_SECRET
               valueFrom:
                 secretKeyRef:

diff --git a/setup/bin/bootstrap-secrets.sh b/setup/bin/bootstrap-secrets.sh
@@ -19,4 +19,8 @@ kubectl -n infra create secret generic minio --from-literal="accesskey=$MINIO_AC
                                              --from-literal="secretkey=$MINIO_SECRET_KEY"
 
 kubectl -n velero create secret generic velero --from-literal="accesskey=$MINIO_ACCESS_KEY" \
-                                               --from-literal="secretkey=$MINIO_SECRET_KEY"
+                                               --from-literal="secretkey=$MINIO_SECRET_KEY"
+
+kubectl -n infra create secret generic traefik-forward-auth-secrets --from-literal="CLIENT_ID=$CLIENT_ID" \
+                                                                    --from-literal="CLIENT_SECRET=$CLIENT_SECRET" \
+                                                                    --from-literal="SECRET=$SECRET"