The CC blobstore access key is stored as a plain text value to cloud-controller-ng-yaml configmap

[Syerram]

Summary

• The CC blobstore access key is stored as a plain text value to the Cloud Controller config map cloud-controller-ng-yaml

    resource_pool:
      ...
      fog_connection:
        ...
        aws_access_key_id: admin
        aws_secret_access_key: 87scyz57wpwn13g38z6s
        aws_signature_version: "2"

• The CC config creates multiple blobstore directories and stores the access key as plain text value for each of the directory configs
  • resource_pool
  • packages
  • droplets
  • buildpacks

Expected behavior

CAPI should use the k8s secret mechanism to consume the secret key. As per Kubernetes docs, the options are to either mount them as files or consume them as environment variables.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/173294964

The labels on this github issue will be updated when the story is started.

[matt-royal]

We've made this change in capi-k8s-release and cf-for-k8s.