From 04f59cfda3efa06798f96080f7be4a3cb5bee13c Mon Sep 17 00:00:00 2001 From: Ryan Baxter Date: Tue, 3 Sep 2019 19:44:24 -0400 Subject: [PATCH] Highlight reference for info on consuming secrets via API. Fixes #252 --- docs/src/main/asciidoc/property-source-config.adoc | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/src/main/asciidoc/property-source-config.adoc b/docs/src/main/asciidoc/property-source-config.adoc index bdf6c818..fee41464 100644 --- a/docs/src/main/asciidoc/property-source-config.adoc +++ b/docs/src/main/asciidoc/property-source-config.adoc @@ -292,10 +292,13 @@ When enabled, the `SecretsPropertySource` looks up Kubernetes for `Secrets` from . Named after the application (as defined by `spring.application.name`) . Matching some labels -Note that, by default, consuming Secrets through the API (points 2 and 3 above) *is not enabled* for security reasons. +*Note:* + +By default, consuming Secrets through the API (points 2 and 3 above) *is not enabled* for security reasons. The permission 'list' on secrets allows clients to inspect secrets values in the specified namespace. Further, we recommend that containers share secrets through mounted volumes. -If you enable consuming Secrets through the API, we recommend that you limit access to Secrets by using an -[authorization policy, such as RBAC](https://kubernetes.io/docs/concepts/configuration/secret/#best-practices). + +If you enable consuming Secrets through the API, we recommend that you limit access to Secrets by using an authorization policy, such as RBAC. +For more information about risks and best practices when consuming Secrets through the API refer to https://kubernetes.io/docs/concepts/configuration/secret/#best-practices[this doc]. If the secrets are found, their data is made available to the application. @@ -411,6 +414,7 @@ If you have all the secrets mapped to a common root, you can set them like: |=== Notes: + * The `spring.cloud.kubernetes.secrets.labels` property behaves as defined by https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-Configuration-Binding#map-based-binding[Map-based binding]. * The `spring.cloud.kubernetes.secrets.paths` property behaves as defined by