docs: add secrets #3057
Merged
docs: add secrets #3057
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Kira-Pilot
reviewed
Jul 20, 2022
| ## Dynamic Secrets | ||
|
|
||
| Dynamic secrets are attached to the workspace lifecycle and automatically | ||
| injected into the workspace. For a little bit of up front template work, |
There was a problem hiding this comment.
Suggested change
| injected into the workspace. For a little bit of up front template work, | |
| injected into the workspace. With a little bit of upfront template work, |
bpmct
approved these changes
Jul 20, 2022
|
|
||
| <blockquote class="info"> | ||
| This article explains how to use secrets in a workspace. To authenticate the | ||
| workspace provisioner, see <a href="./templates/authentication">this</a>. |
There was a problem hiding this comment.
Suggested change
| workspace provisioner, see <a href="./templates/authentication">this</a>. | |
| workspace provisioner, see <a href="./templates/authentication">Provider Authentication</a>. |
| whatever workflow and tools you already use to manage secrets may be brought | ||
| over. | ||
|
|
||
| For most, this workflow is simply: |
There was a problem hiding this comment.
Suggested change
| For most, this workflow is simply: | |
| Often times, this workflow is simply: |
Comment on lines
+23
to
+25
| <a href="./templates#parameters">Template parameters</a> are a dangerous way to accept secrets. | ||
| We show parameters in cleartext around the product. Assume anyone with view | ||
| access to a workspace can also see its parameters. |
There was a problem hiding this comment.
Suggested change
| <a href="./templates#parameters">Template parameters</a> are a dangerous way to accept secrets. | |
| We show parameters in cleartext around the product. Assume anyone with view | |
| access to a workspace can also see its parameters. | |
| For most cases, we do not recommend using <a href="./templates#parameters">template parameters</a> to accept workspace secrets as anyone with view access to a workspace can also see its parameters. |
Reasoning:
- Workspace params do not show up in the dashboard, CLI, or build log unless the template definition explicitly uses a parameter as label for a resource/coder_app. The same could be done with "secrets"
- They may be fetchable via the API (cc @Emyrk)
- The only role that has read access to workspaces also has write access and can enter a terminal and
envorcat project/.envto expose secrets
There was a problem hiding this comment.
Workspace params do not show up in the dashboard, CLI, or build log unless the template definition explicitly uses a parameter as label for a resource/coder_app. The same could be done with "secrets"
This is the case right now, but could change in the near future, so I left out the specifics.
The only role that has read access to workspaces also has write access and can enter a terminal and env or cat project/.env to expose secrets
The specific permission nodes seem likely to change in the near future as we build out RBAC. So, I phrased it in the safest way.
|
:/ didn't realize auto-merge was on. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.