We have below yaml file(holding tokens) as part of project source code(Go), that leads to code vulnerability
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: LS0JCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
server: https://10.xx.xx.xx:443
name: cluster1
- cluster:
certificate-authority-data: LS0JCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCDD
server: https://10.xx.xx.xx:443
name: cluster2
contexts:
- context:
cluster: cluster1
user: cluster1-user
name: cluster1-context
- context:
cluster: cluster2
user: cluster2-user
name: cluster2-context
current-context: cluster2-context
kind: Config
preferences: {}
users:
- name: cluster1-user
user:
auth-provider:
config:
client-id: cccc3-8701-46c8-8830-bbb66b5bf5
client-secret: ccccj~aaaal_.Lo-_343IZSWLwCpF~WOS-
id-token: LS0JCCCCCCCCCCCCCCCCCCCLS0JCCCCCCCCCCCCCCCCCCC
idp-issuer-url: https://login.microsoftonline.com/ccccc92-bbb7-ccfa-95cf-fff5c0f21c/v2.0
refresh-token: LS0JCCCCCCCCCCCCCCCCCCCLS0JCCCCCCCCCCCCCCAAALS0JCCCCCCCCCCCCCCCCCCCLS0JCCCCCCCCCCCCCCCCCCCAAA
name: oidc
- name: cluster2-user
user:
auth-provider:
config:
client-id: cabc3-8701-46c8-8830-bbb66b5bf5
client-secret: cffcj~aaaal_.Lo-_343IZSWLwCpF~WOS-
id-token: LS0JCAAACCCCCCCCCCCCCCCLS0JCCCCCCCCCCCCCCCCCCC
idp-issuer-url: https://login.microsoftonline.com/ccccc92-bbb7-ccfa-95cf-fff5c0f21c/v2.0
refresh-token: LS0JAAAAAAACCCLS0JCCCCCCCCCCCCCCAAALS0JCCCCCCCCCCCCCCCCCCCLS0JCCCBBBBCCCCCCCCCCCAAA
name: oidc
Values of id-token and refresh-token in yaml cannot be carried in source code. Plan is to use pipeline variables
We use Azure DevOps pipeline for CI
How to introduce dynamic yaml that can have placeholder for token vales? Those placeholders should point to pipeline variables(secret) of Azure DevOps
Does Go provide a library to load dynamic yaml?