-
Bug
-
Resolution: Done
-
Normal
-
None
-
4.14
-
None
-
No
-
5
-
devex docs #257 May 27- Jun 17, devex docs #258 Jun 18- Jul 8
-
2
-
False
-
This issue was reported by a customer support specialist, forwarded from an end user:
On this page, section 3.6.3 you describe with some code examples, how users of the OpenShift platform can load secrets into environment variables for their builds: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.14/html/builds_using_buildconfig/creating-build-inputs#builds-using-secrets_creating-build-inputs In 3.6.6 you even start out with explaining how users can copy secrets into the container image for Docker builds. Only at the end of the section there's a warning box that informs the user that this is actually insecure and exposes secrets. Your documentation should only document the secure way of using secrets during builds, otherwise many developers who use your documentation and don't read it thoroughly enough may accidentally publish their credentials.
This issue is reported in 4.14, but please verify whether other versions are impacted.