Helm chart uses the root credentials for MySQL in all services
Currently the Openslice chart in kubernetes/helm/openslice
uses the root credentials of MySQL for all services that need a database, despite configuring a different database for each and creating a portal user (as shown in the example below, Link to the referenced code)
env:
- name: SPRING_APPLICATION_JSON
value: >-
{
"origins":"{{ .Values.rooturl }}",
"spring.datasource.url": "jdbc:mysql://{{ include "openslice.fullname" . }}-mysql/osdb?createDatabaseIfNotExist=true",
"spring.datasource.username": "{{ .Values.oscreds.mysql.username }}",
"spring.datasource.password": "{{ .Values.oscreds.mysql.password }}",
This is not ideal in terms of security since a compromised service has full access to the MySQL server. Instead each service should have its own set of credentials that grant it access to only its database.