kubernetes operator, how to hide property value in describe

user_1736955 0
Viewed 250

I am writing a k8s operator. In my CR file, I want to get password and store it in secret. Everything works fine except this password gets printed on the screen when I describe my object kubectl describe myKind myObject is there any way to hide particular property from spec or at least show *** instead of actual value? just like secret it just shows bytes and not actual value.

Added line before my property // +kubebuilder:validation:Format=password. this add format: password in CRD file but when I describe myObject it still prints all Spec values on the console.

Edit: SO putting more light on this:

my **_types.go snipplet is: 

    // DB username
    DbUser string `json:"dbUser,required"`

    // DB password
    // +kubebuilder:validation:Format=password
    DbPassword string `json:"dbPassword,required"`

so I am making k8s secret out of dbUser and dbPassword I have another option to ask users to create a secret as pre-req but I am not happy with that approach.

Thanks in advance.

kubernetes-operator
1 Answers

You should NOT store passwords / tokens etc. in plain text in the CR. It will be visible to anyone with permissions to read the CR (no matter if k describe shows it or not).

I would recommend changing the CRD spec so users can reference their secret by name. Users will need to create a secret of type opaque then create a CR that looks something like this:

apiVersion: "grp/v1"
kind: "mykind"
metadata:
  name: "my-kind-cr"
  namespace: "default"
spec:
  secretName: mysecret

where the secret would look like this:

apiVersion: v1
kind: Secret
metadata:
  name: dbpassword
  namespace: default
type: Opaque
stringData:
    dbPassword: "my password"
user_77747750
Related