Re: [onap-discuss] [Policy] Passwords hardcoded in policy config files

Tue, 11 Feb 2020 15:39:28 -0800 


On 11.02.2020 18:09, DRAGOSH, PAMELA L (PAM) wrote:
> Krzysztof,
> 
> If we go with #1, we'll have to make code changes in order to accommodate 
> that. It's very late in the development process for our team to do that.

That's true. Nevertheless keep in mind that changes required in the 
source code are rather simple. Here is an example how we did this for DMAAP:

https://gerrit.onap.org/r/#/c/dmaap/datarouter/+/101091/

Just to make sure that we are on the same page I actually have a 
developer that can write this code for you, just would like to get your 
acceptance as there is quite a lot of places where this would need to go.

> 
> Can we get a better understanding of #2 and how that works?

Yeah so the the idea is simple like in many unix programs you allow to 
have multiple config files instead of just one and just merge all of 
them together (with suitable precedence) before parsing the config.

This allows you to split standard configuration (which will be delivered 
as ConfigMap) fro security sensitive one (which would be delivered as a 
secret, mounted as a tmpfs volume to your container)

> 
> Thanks,
> 
> Pam
> 
> On 2/10/20, 5:44 PM, "Krzysztof Opasiak" <[email protected]> wrote:
> 
>      Hi Pam,
>
>      As you probably know, we are working on removing hardcoded credentials
>      from config files and placing them in kubernetes secrets. As a part of
>      this effort I've don some analysis for policy and got below list of
>      passwords that are somehow hardcoded in policy config files:
>
>      policy-pap (config.json):
>
>      restServerParameters.userName
>      restServerParameters.password
>
>      databaseProviderParameters.databaseUser
>      databaseProviderParameters.databasePassword
>
>      policy-xacml-pdp (config.json):
>
>      restServerParameters.userName
>      restServerParameters.password
>
>      policyApiParameters.userName
>      policyApiParameters.password
>
>      policy-common (base.conf):
>
>      JDBC_USER
>      JDBC_PASSWORD
>
>      KEYSTORE_PASSWD
>      TRUSTSTORE_PASSWD
>
>      brmsgw (brmsgw.conf):
>
>      PDP_HTTP_USER_ID=
>      PDP_HTTP_PASSWORD=
>      PDP_PAP_PDP_HTTP_USER_ID=
>      PDP_PAP_PDP_HTTP_PASSWORD=
>
>      repositoryUsername=
>      repositoryPassword=
>
>      BRMS_CLIENT_ID=
>      BRMS_CLIENT_KEY=
>
>      policy-distribution (config.json):
>
>      restServerParameters.userName
>      restServerParameters.password
>
>      receptionHandlerConfigurationParameter.sdcConfiguration.user
>      receptionHandlerConfigurationParameter.sdcConfiguration.password
>
>      policyForwarderConfigurationParameters.xacmlPdpConfiguration.userName
>      policyForwarderConfigurationParameters.xacmlPdpConfiguration.password
>      policyForwarderConfigurationParameters.xacmlPdpConfiguration.clientAuth
>
>      lifecycleApiConfiguration.parameters.apiParameters.userName
>      lifecycleApiConfiguration.parameters.apiParameters.password
>
>      lifecycleApiConfiguration.parameters.papParameters.userName
>      lifecycleApiConfiguration.parameters.papParameters.password
>
>      policy-api (config.json):
>
>      databaseProviderParameters.databaseUser
>      databaseProviderParameters.databasePassword
>
>      policy-apex-pdp (OnapPfConfig.json):
>
>      OnapPfParameterGroup.userName
>      OnapPfParameterGroup.password
>
>      policy-apex-pdp (config.json):
>
>      javax.net.ssl.trustStorePassword
>
>      pdp (pe/pdp.conf)
>
>      PDP_HTTP_USER_ID=
>      PDP_HTTP_PASSWORD=
>      PDP_PAP_PDP_HTTP_USER_ID=
>      PDP_PAP_PDP_HTTP_PASSWORD=
>
>
>      I'd like to get your opinion how would you like us to proceed with those
>      configs. There are two options to retrieve value form a secret:
>
>      1) Environment variable
>
>      2) tmpfs volume
>
>      In most of onap components we are using environment variables but
>      projects are free to choose which option they prefer. Let me know your
>      opinion so that we know how to proceed with this work.
>
>      Best regards,
>      --
>      Krzysztof Opasiak
>      Samsung R&D Institute Poland
>      Samsung Electronics
>
> 

-- 
Krzysztof Opasiak
Samsung R&D Institute Poland
Samsung Electronics

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.

View/Reply Online (#19988): https://lists.onap.org/g/onap-discuss/message/19988
Mute This Topic: https://lists.onap.org/mt/71151740/21656
Group Owner: [email protected]
Unsubscribe: https://lists.onap.org/g/onap-discuss/unsub  
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-























					Reply via email to