Feature Request: First class Kubernetes secret files support about node-config HOT 3 CLOSED

I'm closing this because it can implemented externally to the core project: Write some software which reads the Kubernetes secret volume format and loads it environment variables or a JSON file which can be understood by node-config.

It's not reasonable for a tiny team to support in-core all the different possible secret storage solutions.

from node-config.

Understood. I think you've missed the point of loading from volumes versus environment variables though? It's a security issue not a convenience thing. It would need to be built in to have better security.

For those looking to keep secrets out of their environment variables you could have a wrapper script write your secrets to a node-config compatible file format and source that. It's an extra step but will achieve the same thing.

All you need is a vulnerability in one package that can enumerate process.env and your secrets go public. That's why people keep secrets out of the env. Provided links in original issue elaborate on this further from a k8s perspective.

Thanks for the work your small team does.

from node-config.

All you need is a vulnerability in one package that can enumerate process.env and your secrets go public. That's why people keep secrets out of the env. Provided links in original issue elaborate on this further from a k8s perspective.

... or all you need is a vulnerability in one package that can read the volume that stores the secrets in the k8s format. How is that more secure? If there is an insecure dependency, it has access to whatever the process has access to, whether it's a filesystem path or process.env.

This area was discussed in 2015 #190 where we considered deleting process env values after we loaded them... but it turns out the values are persisted under /proc, so that doesn't add much value.

In #602 there was discussion of adding support for marking values as sensitive so that we dumped out the config file values, those values would be masked in some contexts.

from node-config.