Repository navigation
Add option to pass secrets as files #256
Description
Activity
An alternative could be a URI-like format like authentik uses (https://docs.goauthentik.io/docs/installation/configuration#about-authentik-configurations).
services: couchdb: environment: # Original solution COUCHDB_SECRET_FILE: /run/secrets/COUCHDB_SECRET # Solution like Authentik COUCHDB_SECRET: file:///run/secrets/COUCHDB_SECRET
I have seen your solution more often and it should be easier to implement, so I would prefer it. Just wanted to show a possible alternative.
I’d look at a PR for this, if you’d make one :)
Why did #205 not get merged?
I created a draft PR here: #276 and am curious if this approach would be acceptable before I go further with it. Also I'm currently hitting some issues testing it due to the image build process breaking on my m1 laptop but should be able to move over to a x86 box to wrap the PR.
Reacted by Joshua Harms and Johan Van De Walle
Expected Behavior
I'd like an option to pass secret values as files when appending
_FILEafter the current environment variable used for the value.This behavior is consistent with other images such as MySQL, PostgreSQL (see the docker secrets section in the readme files for both).
Related to: apache/couchdb-helm#140
Current Behavior
Currently, the secret values can only be passed through environment variables which can be problematic when benchmark/scanner tools are used, see: https://avd.aquasec.com/compliance/kubernetes/cis-kubernetes-benchmarks-v1.23-1.23/5.4.1/ or bind mounts.
Enabling the
_FILEoption would allow for a cleaner implementation in the chart and is consistent with other official docker image behavior.Possible Solution
The docker entry point could be updated to use
COUCHDB_ADMIN_USER_FILE,COUCHDB_SECRET_FILEetc environment variables which have the path to a file holding the actual secret value.