Automatically mark Secret data and stringData as secret #803
Conversation
There was a problem hiding this comment.
Overall LGTM.
I'd love to see a way for us in the future to make repetitive changes like the ones in this PR take place in a single file that gets inherited by the resource classes in TS and Python, versus having to touch individual files. I've noticed we've had to do this a couple of times recently. Food for thought 🙂
| @@ -6,6 +6,10 @@ | |||
| - v1.14.x | |||
| - v1.13.x | |||
|
|
|||
| ### Improvements | |||
|
|
|||
| - Automatically mark Secret data and stringData as secret. (https://github.com/pulumi/pulumi-kubernetes/pull/803). | |||
There was a problem hiding this comment.
We should add clarifying docs that this secret encoding only applies to the statefile, as the secret will still be stored in plaintext or b64 in k8s and etcd by default.
As of 1.13 there is a beta feature for encryption at rest for etcd, assuming the user can enable this feature. This would also be a good time to remind folks to lock down etcd and control plane access to admins only if possible - see risks.
IMO we should present both links ^ in the docs.
There was a problem hiding this comment.
@metral Which docs were you thinking? The SDK docs for the Secret class?
There was a problem hiding this comment.
I was leaning towards the ones linked in my prior comment. Figured this would be a good opportunity to nudge the user to consider reading both links and applying them if possible
There was a problem hiding this comment.
Added a comment to the SDK docs for the Secret classes.
Pulumi can make fields in the state as secret to encrypt them in the checkpoint, and prevent them from appearing in plaintext. Kubernetes Secret resources are used to store secrets, so mark the relevant `data` and `stringData` fields as secret in Pulumi by default.
lblackstone
force-pushed
the
lblackstone/secret-fields
branch
from
1b3f01a
to
daf7e27
Compare
Proposed changes
Pulumi can make fields in the state as secret to encrypt them
in the checkpoint, and prevent them from appearing in plaintext.
Kubernetes Secret resources are used to store secrets, so
mark the relevant
dataandstringDatafields as secret inPulumi by default.
Related issues (optional)
Fixes #698