Instead of hard-coding the password, why not auto-generating it so it does not show up in the src and will be distinct for each visitorApp? https://github.com/jdob/visitors-operator/blob/53c2e1d98b5b218dd1a33f2fba8dc13588318b3f/pkg/controller/visitorsapp/mysql.go#L38