whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

secret.md: add base64 risk (#3791)

Browse Source 
* secret.md: add base64 risk

Solves #3681.

Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>

* Update secret.md
This commit is contained in:
Ahmet Alp Balkan
2017-05-17 13:34:29 -07:00
committed by Andrew Chen
parent 7e128d31cf
commit 8b11f9ac40
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/concepts/configuration/secret.md
+4
View File
@@ -805,6 +805,10 @@ Pod level](#use-case-secret-visible-to-one-container-in-a-pod).
- Administrators should limit access to etcd to admin users - Administrators should limit access to etcd to admin users
- Secret data in the API server is at rest on the disk that etcd uses; admins may want to wipe/shred disks - Secret data in the API server is at rest on the disk that etcd uses; admins may want to wipe/shred disks
used by etcd when no longer in use used by etcd when no longer in use
- If you configure the secret through a manifest (JSON or YAML) file which has
the secret data encoded as base64, sharing this file or checking it in to a
source repository means the secret is compromised. Base64 encoding is not an
encryption method and is considered the same as plain text.
- Applications still need to protect the value of secret after reading it from the volume, - Applications still need to protect the value of secret after reading it from the volume,
such as not accidentally logging it or transmitting it to an untrusted party. such as not accidentally logging it or transmitting it to an untrusted party.
- A user who can create a pod that uses a secret can also see the value of that secret. Even - A user who can create a pod that uses a secret can also see the value of that secret. Even