Add mechanism for k8s charms/images to pull secrets from k8s secret stores
Bug #1854759 reported by
Barry Price
This bug affects 2 people
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Canonical Juju |
Triaged
|
Medium
|
Unassigned | ||
| charm-k8s-wordpress |
Confirmed
|
Wishlist
|
Unassigned | ||
Bug Description
Secrets in charm config end up stored in plaintext on the Juju controller - ideally any given charm/image would be able to natively use Kubernetes secrets without exposing them to the controller or (potentially) in logs:
| information type: | Proprietary → Public |
| description: | updated |
| description: | updated |
| summary: |
- Add mechanism for images to pull secrets from k8s secret stores + Add mechanism for k8s charms/images to pull secrets from k8s secret + stores |
| description: | updated |
Revision history for this message
| Pen Gale (pengale) wrote | #1 |
| Changed in juju: | |
| status: | New → Triaged |
| importance: | Undecided → Medium |
| Changed in charm-k8s-wordpress: | |
| status: | New → Confirmed |
| importance: | Undecided → Wishlist |
| Changed in juju: | |
| milestone: | none → 2.9.1 |
| Changed in juju: | |
| milestone: | 2.9.1 → 2.9.2 |
| Changed in juju: | |
| milestone: | 2.9.2 → 2.9.3 |
| Changed in juju: | |
| milestone: | 2.9.3 → 2.9-next |
Revision history for this message
| Canonical Juju QA Bot (juju-qa-bot) wrote | #2 |
| Changed in juju: | |
| importance: | Medium → Low |
| tags: | added: expirebugs-bot |
Revision history for this message
| Harry Pidcock (hpidcock) wrote | #3 |
| Changed in juju: | |
| assignee: | nobody → Ian Booth (wallyworld) |
| importance: | Low → Medium |
| milestone: | 2.9-next → 3.1-beta1 |
| Changed in juju: | |
| milestone: | 3.1-beta1 → 3.2-beta1 |
| Changed in juju: | |
| milestone: | 3.2-beta1 → 3.2-rc1 |
| Changed in juju: | |
| assignee: | Ian Booth (wallyworld) → nobody |
| milestone: | 3.2-rc1 → 3.3.0 |
To post a comment you must log in.
We've got some work scheduled this cycle to plan for better modeled secrets across Juju clouds. Actual implementation would happen sometime in the 21.10 cycle (or later).
I linked this bug into the spec covering the work, so that we are sure to consider k8s native mechanisms when designing our secrets framework.