Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-24392

Document secure way of using secrets during builds

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Normal Normal
    • None
    • 4.14
    • Documentation / Build
    • None
    • No
    • 5
    • devex docs #257 May 27- Jun 17, devex docs #258 Jun 18- Jul 8
    • 2
    • False
    • Hide

      None

      Show
      None

      This issue was reported by a customer support specialist, forwarded from an end user:

      On this page, section 3.6.3 you describe with some code examples, how users of the OpenShift platform can load secrets into environment variables for their builds: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.14/html/builds_using_buildconfig/creating-build-inputs#builds-using-secrets_creating-build-inputs In 3.6.6 you even start out with explaining how users can copy secrets into the container image for Docker builds. Only at the end of the section there's a warning box that informs the user that this is actually insecure and exposes secrets. Your documentation should only document the secure way of using secrets during builds, otherwise many developers who use your documentation and don't read it thoroughly enough may accidentally publish their credentials.

      This issue is reported in 4.14, but please verify whether other versions are impacted.

              joaedwar@redhat.com Joan Edwards
              ahardin@redhat.com Ashley Hardin
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: