Store sensitive details in secrets

[mangelajo]

Things that can be stored on (ideally separate) secrets:

a) the ipsec-psk (or other cable engine related secrets)
b) the token/cert (just a copy of the service account secret created on the broker)

Secrets won't buy extra security because, with the right permissions can be extracted. But it will make it:

1. Cleaner when showing pods, the secrets won't be dumped on screen
2. Easier to update

[mangelajo]

@roytman ^

[stale]

This issue has been automatically marked as stale because it has not had activity for 120 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[tpantelis]

bump

[stale]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[tpantelis]

bump

[nyechiel]

See also #815

[stale]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[skitt]

This is still relevant.

[stale]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[tpantelis]

bump

[stale]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[skitt]

This is still relevant.

[stale]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[dfarrell07]

@skitt is working on this with PRs like submariner-io/submariner-operator#1687

[nyechiel]

@skitt can this be closed now or is there anything else needed?

[skitt]

@skitt can this be closed now or is there anything else needed?

I’m trying to check, but make deploy no longer works for me, I need to fix that first.

Ideally we’d only use secrets to close this issue, but that has to wait for 0.13; perhaps we can track that as a separate issue.

[skitt]

Everything that should be in a secret is now in a secret; I’ve filed submariner-io/submariner-operator#1869 to ensure we remove the non-secret occurrences in 0.13.

[nyechiel]

@skitt anything we should update in our docs to reflect these changes?

[skitt]

@skitt anything we should update in our docs to reflect these changes?

We don’t describe this in the docs currently, I’ve filed submariner-io/submariner-website#678 to make sure we don’t forget to change this situation (but it’s not required for 0.12 IMO, it’s only liable to create problems once we drop support for the non-secret variants).