SpringCloud/spring-cloud-kubernetes
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Highlight reference for info on consuming secrets via API. Fixes #252

Browse Source
This commit is contained in:
Ryan Baxter
2019-09-03 19:44:24 -04:00
parent 43d09bced6
commit 04f59cfda3
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/src/main/asciidoc/property-source-config.adoc
View File

@@ -292,10 +292,13 @@ When enabled, the `SecretsPropertySource` looks up Kubernetes for `Secrets` from
. Named after the application (as defined by `spring.application.name`)
. Matching some labels
Note that, by default, consuming Secrets through the API (points 2 and 3 above) *is not enabled* for security reasons.
*Note:*
By default, consuming Secrets through the API (points 2 and 3 above) *is not enabled* for security reasons. The permission 'list' on secrets allows clients to inspect secrets values in the specified namespace.
Further, we recommend that containers share secrets through mounted volumes.
If you enable consuming Secrets through the API, we recommend that you limit access to Secrets by using an
[authorization policy, such as RBAC](https://kubernetes.io/docs/concepts/configuration/secret/#best-practices).
If you enable consuming Secrets through the API, we recommend that you limit access to Secrets by using an authorization policy, such as RBAC.
For more information about risks and best practices when consuming Secrets through the API refer to https://kubernetes.io/docs/concepts/configuration/secret/#best-practices[this doc].
If the secrets are found, their data is made available to the application.
@@ -411,6 +414,7 @@ If you have all the secrets mapped to a common root, you can set them like:
|===
Notes:
* The `spring.cloud.kubernetes.secrets.labels` property behaves as defined by
https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-Configuration-Binding#map-based-binding[Map-based binding].
* The `spring.cloud.kubernetes.secrets.paths` property behaves as defined by