Hi Pam, As you probably know, we are working on removing hardcoded credentials from config files and placing them in kubernetes secrets. As a part of this effort I've don some analysis for policy and got below list of passwords that are somehow hardcoded in policy config files:
policy-pap (config.json): restServerParameters.userName restServerParameters.password databaseProviderParameters.databaseUser databaseProviderParameters.databasePassword policy-xacml-pdp (config.json): restServerParameters.userName restServerParameters.password policyApiParameters.userName policyApiParameters.password policy-common (base.conf): JDBC_USER JDBC_PASSWORD KEYSTORE_PASSWD TRUSTSTORE_PASSWD brmsgw (brmsgw.conf): PDP_HTTP_USER_ID= PDP_HTTP_PASSWORD= PDP_PAP_PDP_HTTP_USER_ID= PDP_PAP_PDP_HTTP_PASSWORD= repositoryUsername= repositoryPassword= BRMS_CLIENT_ID= BRMS_CLIENT_KEY= policy-distribution (config.json): restServerParameters.userName restServerParameters.password receptionHandlerConfigurationParameter.sdcConfiguration.user receptionHandlerConfigurationParameter.sdcConfiguration.password policyForwarderConfigurationParameters.xacmlPdpConfiguration.userName policyForwarderConfigurationParameters.xacmlPdpConfiguration.password policyForwarderConfigurationParameters.xacmlPdpConfiguration.clientAuth lifecycleApiConfiguration.parameters.apiParameters.userName lifecycleApiConfiguration.parameters.apiParameters.password lifecycleApiConfiguration.parameters.papParameters.userName lifecycleApiConfiguration.parameters.papParameters.password policy-api (config.json): databaseProviderParameters.databaseUser databaseProviderParameters.databasePassword policy-apex-pdp (OnapPfConfig.json): OnapPfParameterGroup.userName OnapPfParameterGroup.password policy-apex-pdp (config.json): javax.net.ssl.trustStorePassword pdp (pe/pdp.conf) PDP_HTTP_USER_ID= PDP_HTTP_PASSWORD= PDP_PAP_PDP_HTTP_USER_ID= PDP_PAP_PDP_HTTP_PASSWORD= I'd like to get your opinion how would you like us to proceed with those configs. There are two options to retrieve value form a secret: 1) Environment variable 2) tmpfs volume In most of onap components we are using environment variables but projects are free to choose which option they prefer. Let me know your opinion so that we know how to proceed with this work. Best regards, -- Krzysztof Opasiak Samsung R&D Institute Poland Samsung Electronics -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#19965): https://lists.onap.org/g/onap-discuss/message/19965 Mute This Topic: https://lists.onap.org/mt/71151740/21656 Group Owner: [email protected] Unsubscribe: https://lists.onap.org/g/onap-discuss/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
