Spring Boot Gradle plugin credentials

user_12432925 0
Viewed 163

I'm using the Spring Boot Gradle plugin to build and push Docker images to a remote Docker registry

bootBuildImage {
    imageName = "docker-repo/app-name"
    publish = true
    docker {
        publishRegistry {
            username = project.property('repoUsername')
            password = project.property('repoPassword')
        }
    }
}

The Docker repository credentials are stored in ~/.gradle/gradle.properties.

Is this secure? Would I need to store a similar ~/.gradle/gradle.properties file in the CI/CD environment?

What are the best approaches from a security perspective?

spring-boot gradle
1 Answers

What I do think about this ( Opinion ) is NO .

Storing the credentials with gradle.properties as plain text is a bad idea . but still it widely usable .

For me , I'd rather use the environment variables as its one level above the plain text , where it get tricky to find .

I can assure you that both ways are bad , but i guess that environment variables is a bit more tricky than plain text .

this is my gradle method to retrive env variables or to look at gradle.properties

artifactoryUser = getConfigurationProperty("ARTIFACTORY_USER", "artifactoryUser", null)
artifactoryPwd = getConfigurationProperty("ARTIFACTORY_PWD", "artifactoryPwd", null)

String getConfigurationProperty(String envVar, String sysProp, String defaultValue) {
    def result = System.getenv(envVar) ?: project.findProperty(sysProp)
    result ?: defaultValue
}

I use it and I am sure that there is a more secure way to do so .

user_113019410
Related