-
Notifications
You must be signed in to change notification settings - Fork 144
Open
Labels
area/securityFor security best practicesFor security best practicesbugSomething isn't workingSomething isn't working
Milestone
Description
Right now our init container in the NGINX deployment accesses the API to gather data for NGINX Plus licensing reasons. However, the data that is gathered can be provided directly to the init container.
We need to remove API access from the NGINX Deployment for security reasons. This means updating the init container to no longer do this, and removing the automountServiceAccountToken from the Deployment spec.
Acceptance
- update the init container to no longer access the k8s API, and instead gets the necessary data (ClusterID) via a CLI argument
- node count is variable and doesn't need to be included on startup
- only set this data and create the deployment context file if we're running NGINX Plus
- remove
automountServiceAccountTokenfrom the NGINX Deployment spec, and ensure that the token is no longer set
hafe
Metadata
Metadata
Assignees
Labels
area/securityFor security best practicesFor security best practicesbugSomething isn't workingSomething isn't working
Type
Projects
Status
🆕 New