feat: restrict access to secrets #1009
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jnonino
changed the title
2 tasks
ivankatliarchuk
approved these changes
Feb 21, 2024
ivankatliarchuk
approved these changes
Feb 21, 2024
There was a problem hiding this comment.
Hello @jnonino,
Thank you for your contribution.
The PR looks good. I'll test it.
In the mean time WDYT about renaming accessibleSecrets by secretResourceNames ?
|
Hi @darkweaver87, I'll change the name of the field. I was actually expecting feedback about it 😄 |
|
Linking with issue traefik/traefik#7097 in Traefik repo as the discussion is relevant to the change added in this PR. |
mloiseleur
approved these changes
Mar 8, 2024
darkweaver87
added
status/3-needs-merge
and removed
status/3-needs-merge
bot/need-human-merge
labels
|
@jnonino , it looks like our bot is not able to merge this PR because it can't rebase on master and push to your branch. Would you mind to rebase it ? |
|
@jnonino any chance that you can rebase this PR ? |
Done!!! Sorry for the delay |
mloiseleur
added
status/3-needs-merge
and removed
contributor/needs-resolve-conflicts
labels
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR aims to allow to users to restrict the secrets accesible by Traefik on the Kubernetes cluster. For this reason, I have added a new field into RBAC configuration
secretResourceNames. By default, that value is an empty list ([]) and the behaviour is the same as before this change, all secrets are accesible from Traefik.When that field contains one or more secret names, then only those secrets are the ones accessible from Traefik.
Motivation
Access to secrets without limits raises a security concern and Traefik should have access only to the secrets it requires to work properly, for example TLS certificates stored in secrets and used by Traefik. All other secrets in the cluster should not be accessible.
This was raised in the issue 1006.
More
make testand all the tests passed