About the use of secrets

[tcoch]

Hi there,

I would like to propose a future feature.
When using Symfony's secrets, a sensitive file is produced : config/secrets/prod/prod.decrypt.private.php. As it is sensitive, we should not be seeing this inside the container's image of an app.
Therefore, we need to be able to inject its value (the file content) as a secret.

My knowledge of Kubernetes is not advanced, but I can propose the following, open for discussion:

templates/prod-secret-decrypt.yaml

apiVersion: v1
kind: Secret
metadata:
  name: prod-secret-decrypt-file
type: Opaque
data:
  decrypt: {{ .Values.secret.fichier }}

templates/deployment.yaml

spec:
  template:
    spec:
      containers:
        - name : <name>
          [...]
          volumeMounts:
            - mountPath: /app/config/secrets/prod/prod.decrypt.private.php
              subPath: prod.decrypt.private.php
              name: decrypt-prod-secrets
              readOnly: true
      volumes:
        - name: decrypt-prod-secrets
          secret:
            secretName: prod-secret-decrypt-file
            items:
              - key: decrypt
                path: prod.decrypt.private.php

Thanks you for your work !

[FabienPapet]

Hello, thank you for the idea.

This definitely has a link with volumes management, which is not implemented yet, but a draft PR (#1 ) is already opened and I'll try to finish it when I have some time.

[FabienPapet]

PR is updated, is that what you were thinking of ?

[tcoch]

PR is updated, is that what you were thinking of ?

Looks good to me yes! Thank you!