28Hus commented on code in PR #1565:
URL: https://github.com/apache/dubbo-admin/pull/1565#discussion_r4111304339
##########
release/kubernetes/dubbo-system/dubbo-admin.yaml:
##########
@@ -39,9 +41,15 @@ spec:
serviceAccountName: dubbo-admin
containers:
- name: dubbo-admin
- image: apache/dubbo-admin:0.7.0
- imagePullPolicy: IfNotPresent
- volumeMounts:
+ image: apache/dubbo-admin:0.7.0
+ imagePullPolicy: IfNotPresent
+ env:
Review Comment:
Thanks for pointing this out. The dubbo-admin-auth Secret is created
separately using the kubectl create secret generic command at the top of this
manifest, before applying the Deployment. That command creates the Secret
resource with a unique key for each installation. The Deployment then reads its
session-secret key through secretKeyRef. We intentionally do not commit a
Secret manifest containing a fixed signing key, since that would recreate the
shared-key issue this PR fixes. Storing the signing key in the ConfigMap would
also expose it as ordinary configuration data.
Of course, I have only considered the security aspect; regarding usability,
we could later implement a feature that generates a strong, random key if the
secret is missing from the YAML file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
