github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-03 09:22:44 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #6687 from ddysher/fix-doc

Browse Source 
Small fix for secret doc
This commit is contained in:
Daniel Smith 2015-04-10 13:44:35 -07:00
commit 6a9ba0cf36
1 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docs/secrets.md
View File

@ -21,7 +21,7 @@ This is an example of a simple secret, in json format:
"data": { "data": {
"username": "dmFsdWUtMQ0K", "username": "dmFsdWUtMQ0K",
"password": "dmFsdWUtMg0KDQo=" "password": "dmFsdWUtMg0KDQo="
} }
} }
``` ```
@ -110,7 +110,7 @@ To create a pod that uses an ssh key stored as a secret, we first need to create
{ {
"apiVersion": "v1beta2", "apiVersion": "v1beta2",
"kind": "Secret", "kind": "Secret",
"id": "ssh-key-secret", "id": "ssh-key-secret",
"data": { "data": {
"id-rsa.pub": "dmFsdWUtMQ0K", "id-rsa.pub": "dmFsdWUtMQ0K",
"id-rsa": "dmFsdWUtMg0KDQo=" "id-rsa": "dmFsdWUtMg0KDQo="
@ -318,7 +318,7 @@ Pod level](#use-case-two-containers).
### Risks ### Risks
- Applications still need to protect the value of secret after reading it from the volume, - Applications still need to protect the value of secret after reading it from the volume,
such not accidentally logging it or transmitting it to an untrusted party. such as not accidentally logging it or transmitting it to an untrusted party.
- A user who can create a pod that uses a secret can also see the value of that secret. Even - A user who can create a pod that uses a secret can also see the value of that secret. Even
if apiserver policy does not allow that user to read the secret object, the user could if apiserver policy does not allow that user to read the secret object, the user could
run a pod which exposes the secret. run a pod which exposes the secret.
@ -330,4 +330,3 @@ Pod level](#use-case-two-containers).
by impersonating the kubelet. It is a planned feature to only send secrets to by impersonating the kubelet. It is a planned feature to only send secrets to
nodes that actually require them, to restrict the impact of a root exploit on a nodes that actually require them, to restrict the impact of a root exploit on a
single node. single node.