Skip to content
This repository has been archived by the owner on Feb 22, 2022. It is now read-only.

[stable/mysql] Test pod/configmap expose credentials for DB #9762

Closed
jrnt30 opened this issue Dec 5, 2018 · 2 comments
Closed

[stable/mysql] Test pod/configmap expose credentials for DB #9762

jrnt30 opened this issue Dec 5, 2018 · 2 comments
Labels
lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.

Comments

@jrnt30
Copy link
Contributor

jrnt30 commented Dec 5, 2018

Noticed a small issue/concern with the current stable MySQL chart as we were playing around with it that I would consider a bug (or at least a departure from norms).

Issue:

  • Currently has a templates/test/ directory for some hook tests to validate the configuration of the database.
  • A ConfigMap is used to write out the test command to execute via the test hook
  • The ConfigMap's script that is rendered makes direct use of the secret for the DB.

Suggested Solution:
Rework the test pod so that the password is injected in the same fashion it is for the "real" deployment. This would ensure that folks with lower privileges (i.e. unable to read secrets or exec into the pods themselves) would have a much harder time discovering the password in the first place.

@stale
Copy link

stale bot commented Jan 5, 2019

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Any further update will cause the issue/pull request to no longer be considered stale. Thank you for your contributions.

@stale stale bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 5, 2019
@stale
Copy link

stale bot commented Jan 19, 2019

This issue is being automatically closed due to inactivity.

@stale stale bot closed this as completed Jan 19, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.
Projects
None yet
Development

No branches or pull requests

1 participant