Revise wording for Secret concept #27716

sftim · 2021-04-25T10:44:25Z

This change is a subset of the changes from PR #24169 (a PR that has proved too big to review).

I will follow this up with further PRs to incorporate the other changes that #24169 suggests.

/sig storage

netlify · 2021-04-25T11:00:15Z

✔️ Deploy Preview for kubernetes-io-main-staging ready!

🔨 Explore the source changes: 7a8389c

🔍 Inspect the deploy log: https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/60fb6bcaac11490008f24e2c

😎 Browse the preview: https://deploy-preview-27716--kubernetes-io-main-staging.netlify.app

content/en/docs/concepts/configuration/secret.md

shannonxtreme · 2021-04-25T14:52:05Z

content/en/docs/concepts/configuration/secret.md

@@ -31,7 +35,10 @@ access, or anyone with access to Kubernetes' underlying data store, etcd. In
 order to safely use Secrets, it is recommended you (at a minimum):

 1. [Enable Encryption at Rest](/docs/tasks/administer-cluster/encrypt-data/) for Secrets.
-2. [Enable or configure RBAC rules](/docs/reference/access-authn-authz/authorization/) that restrict reading and writing the Secret. Be aware that secrets can be obtained implicitly by anyone with the permission to create a Pod.
+2. [Enable or configure RBAC rules](/docs/reference/access-authn-authz/authorization/) that
+   restrict reading and writing the Secret. Be aware that secrets can be obtained


restrict reading from and writing to the Secret.

This change is a subset of the changes from PR #24169 (a PR that has proved too big to review).

I will follow this up with further PRs to incorporate the other changes that #24169 suggests. Anyone else can make those follow-ups; it doesn't have to be me.

shannonxtreme · 2021-04-25T14:54:04Z

content/en/docs/concepts/configuration/secret.md

-2. [Enable or configure RBAC rules](/docs/reference/access-authn-authz/authorization/) that restrict reading and writing the Secret. Be aware that secrets can be obtained implicitly by anyone with the permission to create a Pod.
+2. [Enable or configure RBAC rules](/docs/reference/access-authn-authz/authorization/) that
+   restrict reading and writing the Secret. Be aware that secrets can be obtained
+   implicitly by anyone with the permission to create a Pod.


Be aware that Secrets can be obtained.... (capitalize S)

What does "can be obtained implicitly" mean? Maybe reword to "Be aware that anyone with the permission to create a pod can retrieve Secrets."?

This change is a subset of the changes from PR #24169 (a PR that has proved too big to review).

I will follow this up with further PRs to incorporate the other changes that #24169 suggests. Anyone else can make those follow-ups; it doesn't have to be me.

shannonxtreme · 2021-04-25T14:55:04Z

content/en/docs/concepts/configuration/secret.md

@@ -47,6 +54,10 @@ A Secret can be used with a Pod in three ways:
 - As [container environment variable](#using-secrets-as-environment-variables).
 - By the [kubelet when pulling images](#using-imagepullsecrets) for the Pod.

+The Kubernetes control plane also uses Secrets; for example,


also uses Secrets. For example, ...

shannonxtreme

Added some suggestions for clarity and consistency :)

kbhawkey · 2021-04-25T23:10:53Z

Page preview:
https://deploy-preview-27716--kubernetes-io-master-staging.netlify.app/docs/concepts/configuration/secret/

kbhawkey · 2021-04-25T23:28:20Z

content/en/docs/concepts/configuration/secret.md

-{{< glossary_tooltip term_id="pod" >}} definition or in a
-{{< glossary_tooltip text="container image" term_id="image" >}}.
-See [Secrets design document](https://git.k8s.io/community/contributors/design-proposals/auth/secrets.md) for more information.
-
 A Secret is an object that contains a small amount of sensitive data such as


I think it would help to add that a Secret is a core Kubernetes object (or something similar to that text)?
https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1/#get-read-the-specified-secret

This change is a subset of the changes from PR #24169 (a PR that has proved too big to review).

I will follow this up with further PRs to incorporate the other changes that #24169 suggests. Anyone else can make those follow-ups; it doesn't have to be me.

Yes, that's nice.

kbhawkey · 2021-06-10T01:15:30Z

content/en/docs/concepts/configuration/secret.md

-strings. By default they can be retrieved - as plain text - by anyone with API
-access, or anyone with access to Kubernetes' underlying data store, etcd. In
-order to safely use Secrets, it is recommended you (at a minimum):
+Kubernetes Secrets are, by default, stored unencrypted in the API server's underlying data store (etcd). Anyone with API access can retrieve or modify a Secret, and so can anyone with access to etcd.


@sftim, These changes look good.
Should these new lines be wrapped at around the same character length as the other lines?

kbhawkey · 2021-06-10T01:18:54Z

Page preview:
https://deploy-preview-27716--kubernetes-io-master-staging.netlify.app/docs/concepts/configuration/secret/

kbhawkey · 2021-07-03T15:41:00Z

/kind cleanup
/approve

k8s-ci-robot · 2021-07-03T15:41:42Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kbhawkey

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [kbhawkey]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sftim · 2021-07-24T01:24:31Z

Rebased, should be ready for review.

celestehorgan · 2021-07-27T18:04:28Z

I'm making an executive call here, @sftim, and choosing to treat the remaining unresolved issues as non-blocking :)

Thank you so much for your hard work on this.

/lgtm

k8s-ci-robot · 2021-07-27T18:04:36Z

LGTM label has been added.

Git tree hash: 3b21e8e7d8d96c5ffe7fec90f76716c1f148a023

zhangguanzhang · 2021-08-05T12:39:01Z

@tengqm need sync to zh

tengqm · 2021-08-06T09:41:56Z

@zhangguanzhang With dev-1.22 "becoming" the new "main" branch, we have a lot of pages to resync. Will initiate an sprint to get this done. Thanks for reminding.

I’ve been a member for a fair bit. Reviewed, worked on, or been involved in tracking 50+ PRs. Some highlights: * kubernetes#26848 * kubernetes#27716 * kubernetes#27739 * kubernetes#28870 * kubernetes#28740 * kubernetes#28617 Search for PRs involving me: https://github.com/kubernetes/website/pulls?page=2&q=is%3Apr+involves%3Ashannonxtreme

k8s-ci-robot added sig/storage Categorizes an issue or PR as relevant to SIG Storage. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. language/en Issues or PRs related to English language labels Apr 25, 2021

k8s-ci-robot requested review from mikedanese and rajeshdeshpande02 April 25, 2021 10:44

k8s-ci-robot added sig/docs Categorizes an issue or PR as relevant to SIG Docs. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Apr 25, 2021

shannonxtreme reviewed Apr 25, 2021

View reviewed changes

content/en/docs/concepts/configuration/secret.md Outdated Show resolved Hide resolved

shannonxtreme reviewed Apr 25, 2021

View reviewed changes

content/en/docs/concepts/configuration/secret.md Outdated Show resolved Hide resolved

shannonxtreme reviewed Apr 25, 2021

View reviewed changes

shannonxtreme suggested changes Apr 25, 2021

View reviewed changes

kbhawkey reviewed Apr 25, 2021

View reviewed changes

sftim force-pushed the 20210425_revise_secret_concept branch 2 times, most recently from e6ca115 to 9a946d2 Compare June 9, 2021 17:10

kbhawkey reviewed Jun 10, 2021

View reviewed changes

k8s-ci-robot added the kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. label Jul 3, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 3, 2021

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 11, 2021

Revise wording for Secret concept

7a8389c

sftim force-pushed the 20210425_revise_secret_concept branch from 9a946d2 to 7a8389c Compare July 24, 2021 01:24

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 24, 2021

k8s-ci-robot assigned celestehorgan Jul 27, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 27, 2021

k8s-ci-robot merged commit 0f8a345 into kubernetes:main Jul 27, 2021

sftim mentioned this pull request Sep 9, 2021

[WIP] Rewrite Secret concept #24169

Closed

shannonxtreme mentioned this pull request Nov 11, 2021

Add shannon to reviewers #30443

Merged

sftim deleted the 20210425_revise_secret_concept branch December 8, 2021 21:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Revise wording for Secret concept #27716

Revise wording for Secret concept #27716

sftim commented Apr 25, 2021

netlify bot commented Apr 25, 2021 •

edited

Loading

shannonxtreme Apr 25, 2021

sftim Jun 9, 2021

shannonxtreme Apr 25, 2021

sftim Jun 9, 2021

shannonxtreme Apr 25, 2021

shannonxtreme left a comment

kbhawkey commented Apr 25, 2021

kbhawkey Apr 25, 2021

sftim Jun 9, 2021

kbhawkey Jun 10, 2021

kbhawkey Jun 10, 2021

kbhawkey commented Jun 10, 2021

kbhawkey commented Jul 3, 2021

k8s-ci-robot commented Jul 3, 2021

sftim commented Jul 24, 2021

celestehorgan commented Jul 27, 2021

k8s-ci-robot commented Jul 27, 2021

zhangguanzhang commented Aug 5, 2021

tengqm commented Aug 6, 2021

Revise wording for Secret concept #27716

Revise wording for Secret concept #27716

Conversation

sftim commented Apr 25, 2021

netlify bot commented Apr 25, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shannonxtreme left a comment

Choose a reason for hiding this comment

kbhawkey commented Apr 25, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kbhawkey commented Jun 10, 2021

kbhawkey commented Jul 3, 2021

k8s-ci-robot commented Jul 3, 2021

sftim commented Jul 24, 2021

celestehorgan commented Jul 27, 2021

k8s-ci-robot commented Jul 27, 2021

zhangguanzhang commented Aug 5, 2021

tengqm commented Aug 6, 2021

netlify bot commented Apr 25, 2021 •

edited

Loading