-
Bug
-
Resolution: Done
-
Normal
-
None
-
None
-
None
-
None
Description of Problem
Error: SIGMA.container_storing_secret_in_environment_variable (CWE-526): [#def3] [important]
argo_cd/app/manifests/base/application-controller-deployment/argocd-application-controller-deployment.yaml:26: Sigma main event: The Kubernetes container stores secrets in environment variables, which could be leaked if the environment is logged.
argo_cd/app/manifests/base/application-controller-deployment/argocd-application-controller-deployment.yaml:26: remediation: Provide access to secrets via volume mounts instead of setting `valueFrom.secretKeyRef` in `env`.
# 24| valueFrom:
# 25| secretKeyRef:
# 26|-> key: auth
# 27| name: argocd-redis
# 28| - name: ARGOCD_RECONCILIATION_TIMEOUT
There are multiple definitions for CWE 526, the complete list of instances can be found here:
Problem Reproduction
- SAST scan results from v1.16.0-15 RC
Fix Approaches
- Remediation: Provide access to secrets via volume mounts instead of setting `valueFrom.secretKeyRef` in `env`.
Acceptance Criteria
- SAST scan results for the next release do not contain CWE 526
- is cloned by
-
-
- Review
-
-
-
- Closed
-
-
-
- Closed
-
- is related to
-
-
- Closed
-
- relates to
-
GITOPS-7167 Enhance Redis password handling in Argo CD by allowing credentials to be sourced from volume mounts.
-
- Review
-