Re:Dockerfile Security Best Practices
by csunbird on Wednesday October 14, 2020 @11:18AM
(#24777479)
> 1. OpenShift/Kubernetes Secrets mounted into the Pod at runtime.
Do you recommend mounting secrets as environment variables to the kubernetes pods instead of files?
Re:Dockerfile Security Best Practices
by freedomben on Wednesday October 14, 2020 @11:29AM
(#24777666)
Yes, that is by far my preference. Much more 12 factor app-ish and framework independent. A lot of Java apps will want files though, so sometimes it isn't possible.
Files should be used over environment variables. The file system at least as some form of RBAC through file permissions.
There are competing pieces of advice for secure distribution of secrets, but my current preference comes down to one of these ways, depending on the organization:
1. OpenShift/Kubernetes Secrets mounted into the Pod at runtime.
2. Hashicorp Vault (has a really well designed API. It's very usable just with curl, which makes using it a joy)
3. Sealed Secrets (less experience here but it's looking positive right now) - https://github.com/bitnami-labs/sealed-secrets
If you're using a different PaaS besides OpenShift, it may also offer options worth considering (although do think about portability. These days apps move platforms every few years on average, though I think that may be changing now that K8s is becoming the standard).