Skip to content
This repository has been archived by the owner on Jun 1, 2022. It is now read-only.

Should use a secret for sensitive brigade-github-app configuration #48

Closed
krancour opened this issue Oct 31, 2019 · 0 comments · Fixed by #49
Closed

Should use a secret for sensitive brigade-github-app configuration #48

krancour opened this issue Oct 31, 2019 · 0 comments · Fixed by #49
Assignees
Labels
bug Something isn't working

Comments

@krancour
Copy link
Contributor

Currently, the brigade-github-app chart creates a config map that includes a sensitive key.pem field. The deployment mounts this config map to /etc/brigade-github-app and, in turn, the containerized brigade-github-app process in each pod consumes /etc/brigade-github-app/key.pem.

Since the contents of key.pem are sensitive, it would be more proper and more safe to store this in a secret.

This can be accomplished pretty easily with changes to the chart and no changes to the brigade-github-app software itself.

This is not a breaking change:

  1. Eliminate the brigade-github-app config map (since key.pem) is its only field anyway.

  2. Add key.pem field to the existing brigade-github-app secret.

  3. In the deployment, mount the brigade-github-app secret to /etc/brigade-github-app in place of the brigade-github-app config map.

@krancour krancour added the bug Something isn't working label Oct 31, 2019
@krancour krancour self-assigned this Oct 31, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant