potiuk commented on PR #68975: URL: https://github.com/apache/airflow/pull/68975#issuecomment-4903059291
It's an interesting one - I am not sure if we want to merge this one. This gives false sense of security - you know you are not supposed to pass secrets in K8S Pod Operator Env Vars ? > Never use environment variables to pass secrets (for example connection authentication information) to Kubernetes Pod Operator. Such environment variables will be visible to anyone who has access to see and describe PODs in Kubernetes. Instead, pass your secrets via native Kubernetes Secrets or use Connections and Variables from Airflow. For the latter, you need to have apache-airflow package installed in your image in the same version as Airflow you run your Kubernetes Pod Operator from). [Reference](https://airflow.apache.org/docs/apache-airflow-providers-cncf-kubernetes/stable/operators.html#id18)[ΒΆ](https://airflow.apache.org/docs/apache-airflow-providers-cncf-kubernetes/stable/operators.html#reference) I will psss that to the security team for consideration - but I think this one - especially that it addresses something we explicitly told is a bad practice is not a good idea -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
