-
Notifications
You must be signed in to change notification settings - Fork 165
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: one backend obj for all apps #1640
base: main
Are you sure you want to change the base?
Conversation
|
GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
---|---|---|---|---|---|
7237573 | Triggered | Generic Password | 11acedf | tests/fixtures/env/secrets.settings.yaml | View secret |
12853661 | Triggered | Generic High Entropy Secret | 11acedf | tests/fixtures/env/apps/secrets.harbor.yaml | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
This PR aims to make the configuration of Object Storage and Backups more consistent and easier to maintain.
OBJ is now configured in the platform settings. A user can choose between disabled (no OBJ is configured), minioLocal (for PoC/dev use-cases) and Linode (using Linode OBJ service). Integrated applications like Harbor, cnpg, Loki, Tempo and Velero, consume the OBJ configuration and do not need to be configured independently.
With this PR we do not support any other OBJ service. If a user would like to use AWS S3 or Azure Blob, then the user needs to configure this using rawValues per app.
Other changes:
cluster.provider
. Now there are only 2 providers:linode
andcustom
settings.backup
sectionloki
,velero
,tempo
,harbor
andcnpg
NOTE:
There is no option in the velero chart to define an additional
env
using asecretKeyRef
. I made some changes to the chart and will submit a PR to support Linode Velero plugin in Velero Helm chart. See here for more info about the Linode Velero plugin: https://github.com/linode/velero-plugin/tree/main?tab=readme-ov-file