Skip to content

Conversation

@bryopsida
Copy link
Contributor

@bryopsida bryopsida commented Jun 1, 2024

What this PR does / why we need it:

This PR adds a value option enableSecretsAsFiles which is disabled by default, but when enabled toggles the rendered manifests to not use secrets as environment variables.

This addresses this CIS benchmark finding from the trivy operator. In additions to some of the other benchmarks trivy supports

Which issue this PR fixes

fixes: #140

Evidence

TODO add trivy report with default values
TODO add trivy report with custom values

TODO

  • Update admin hash init container to follow the option
  • Update couchdb container to follow the behavior for setting admin user, password, erlang cookie, and couchdb secret
  • Update probes to use a .netrc file when chttpd.require_valid_user and enableSecretsAsFiles are true
  • Rebase/squash to single commit once everything looks good.

Special notes for your reviewer:

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.

  • Chart Version bumped
  • e2e tests pass
  • Variables are documented in the README.md
  • NEWS.md updated

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Option to project secrets as files

1 participant