Use kubernetes Secrets for credentials and other sensitive data in the helm chart
Currently the Openslice chart in kubernetes/helm/openslice
templates the credentials for the database and message broker and other secrets directly into the Deployment
/StatefulSet
of the services that need it (as shown in the example below, Link to the referenced code)
env:
- name: SPRING_APPLICATION_JSON
value: >-
{
"origins":"{{ .Values.rooturl }}",
"spring.datasource.url": "jdbc:mysql://{{ include "openslice.fullname" . }}-mysql/osdb?createDatabaseIfNotExist=true",
"spring.datasource.username": "{{ .Values.oscreds.mysql.username }}",
"spring.datasource.password": "{{ .Values.oscreds.mysql.password }}",
This from a security standpoint is less than ideal, since kubernetes treats these as regular values. This should instead be refactored to use the kubernetes Secret
resource.