Open
Description
It could be very nice to not provide environment variable through the pods spec as it is stored in etcd (which is mostly in plaintext).
Also, the creds can be easily retrieved with a kubectl describe pods $podname , which is not directly an issue as we need permission but i think getting creds with only a describe is a bit too much and people need to be aware of that.
A good enhancement could be to use an init-container with a one time used token that will permit to retrieve credentials and share them with SHM inter-container. The creds wont be expose in the pods spec, only a token that couldn't be reused.
The init-container will have 3 principals mission :
- generate db password
- share it on the shared memory
- store it on the state for renewer and revoker.
The token will have 2 acces to 2 thing :
- database endpoint
- vault kv endpoint