Merge pull request #25498 from adambkaplan/ssh-auth-secret-caution

Caution Note for ssh-auth Secrets
2020-12-16 13:50:31 -08:00
parent 45135da395 7b80f63dbc
commit 77362e21ec
1 changed files with 7 additions and 0 deletions
@@ -271,6 +271,13 @@ However, using the builtin Secret type helps unify the formats of your credentia
 and the API server does verify if the required keys are provided in a Secret
 configuration.

+{{< caution >}}
+SSH private keys do not establish trusted communication between an SSH client and
+host server on their own. A secondary means of establishing trust is needed to
+mitigate "man in the middle" attacks, such as a `known_hosts` file added to a
+ConfigMap.
+{{< /caution >}}
+
 ### TLS secrets

 Kubernetes provides a builtin Secret type `kubernetes.io/tls` for to storing