4 ms·
What do you consider a secret? What other system do you recommend which has the feature you want? I cant see how one would inject data into a process without p
by antocv 7y ago
What do you consider a secret? What other system do you recommend which has the feature you want?
I cant see how one would inject data into a process without ptracing/gdb-attaching to it, messing with its internal memory, or just use environment variables or argument list. If you put it on a file somewhere, you still have to tell the process where the file is by an argument or env and also manage that "volume" and uid space of that file and process.
Kubernetes secrets have nothing to do with containers - it anyway usually exposes the secret as env var or volume and file.
- heyoni 7y agoI smell potential for a fun tutorial with that last part!
- KaiserPro 7y agoA secret is anything that you don't want to be public. normally API keys, or some other similar token. Its not even a case of stopping people attaching a debugger, there is simply not standard mechanism. Some sort of secret store should be a primitive in any container/VM/unikernel built since 2012. The "recommended" way is to map a volume in to a container. But thats rubbish, there is no standard place to put it, and crucially no API to fill the volume full of secrets. How do I map the specific volume to a container? you can't its manual. what would be nice is either a tagged value store, so you can specify a tag when you build a container, so that you have a way to signal which secrets your container wants. Or a lump of the container that you can encrypt, that has a key value store in it. There are lots of documents telling you that you _shouldn't_ embed secrets in your container, but there are not many howtos that don't involve the engineering equivalent of gaffer tape and wet string. Most of this has now been solved by better[] orchestration systems. [] not great though.