Read InfluxDB credentials from a secret #280
Labels
kind/enhancement
Enhancement of an existing feature
priority/P2
Slight inconvenience or annoyance to applications, system continues to function
Milestone
Description
Right now the only way to pass influxdb credentials to pravega (needed to store pravega metrics) is via
pravega_options
block of the custompravegacluster
resource.As a result the above credentials are hanging around in plain text and are available via
kubectl get pravegacluster -o yaml
command.It would be much better if pravega-operator had an option to take a name of the influxdb secret that holds the credentials (assuming that influxdb is deployed in the same namespace as pravega) and read the influxdb credentials from there.
Importance
Having the influxdb credentials in plain text in the CR poses significant security risk.
Location
https://github.com/pravega/pravega-operator/blob/master/pkg/apis/pravega/v1alpha1/pravega.go
Suggestions for an improvement
Add a new
influxdb_secret
spec to pravega spec, that would take the name of influxdb secret, read database credentials from the secret, then createcontroller.metrics.influxDBUserName
andcontroller.metrics.influxDBPassword
options for pravega controllermetrics.influxDBUserName
andmetrics.influxDBPassword
options for pravega segmentstoreThe text was updated successfully, but these errors were encountered: