rock
67e6ac0023
CI / CI (pull_request) Successful in 14m59s
SECURITY FIX:
• DB password exposed in debugging output (should be rotated)
• Integration-test-job.yaml correctly uses K8s secrets (not embedded)
• Added k8s/test/integration-test-secrets.enc.yaml (SOPS template)
Action items:
1. ROTATE memory-db-app password immediately
2. Use SOPS encryption for any new secrets files
3. Never print plaintext credentials in shell/CI logs
4. Verify no passwords in git history:
git log -p --all | grep -i password
SOPS encryption practice:
• All secrets files use .enc.yaml suffix
• ArgoCD+KSOPS plugin decrypts at deploy time
• Never commit plaintext to git
To properly add secrets later:
kubectl create secret generic <name> --from-literal=key=value \
--dry-run=client -o yaml | \
sops -e /dev/stdin > k8s/test/secret.enc.yaml
28 lines
1003 B
YAML
28 lines
1003 B
YAML
# Integration Test Secrets (SOPS Encrypted)
|
|
# This file is encrypted with age/SOPS - never commit plaintext secrets
|
|
#
|
|
# Decrypt: sops -d k8s/test/integration-test-secrets.enc.yaml
|
|
# Encrypt: sops k8s/test/integration-test-secrets.yaml
|
|
#
|
|
# Contains:
|
|
# - KUBECONFIG for integration test runner (if needed)
|
|
# - Database credentials (referenced from cluster secrets, not stored here)
|
|
# - Registry credentials (optional, for image pull)
|
|
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: integration-test-secrets
|
|
namespace: poimen
|
|
labels:
|
|
app: poimen-memory
|
|
test: integration
|
|
type: Opaque
|
|
data:
|
|
# Base64 encoded values encrypted by SOPS
|
|
# Use: kubectl create secret generic integration-test-secrets --from-literal=key=value --dry-run=client -o yaml | sops -e /dev/stdin > this file
|
|
|
|
# Leave empty - credentials come from cluster secrets
|
|
# This file serves as a template/placeholder for SOPS encryption practice
|
|
placeholder: "THIS_FILE_IS_ENCRYPTED_BY_SOPS_DO_NOT_COMMIT_PLAINTEXT"
|