{"action":"created","comment":{"url":"https://api.github.com/repos/csrwng/kubernetes/pulls/comments/23855048","id":23855048,"diff_hunk":"@@ -0,0 +1,187 @@\n+# Secret Distribution\n+\n+## Abstract\n+\n+A proposal for the distribution of secrets (passwords, keys, etc) to containers inside Kubernetes\n+using a custom volume type.\n+\n+## Motivation\n+\n+Secrets are needed in containers to access internal resources like the Kubernetes master or\n+external resources such as git repositories, databases, etc. \n+\n+A goal of this design is to eliminate or minimize the modifications to containers in order to\n+access secrets. Secrets should be placed where the container expects them to be.\n+\n+## Constraints and Assumptions\n+\n+* This design does not prescribe a method for storing/transmitting secrets\n+* Encryption and node security are orthogonal concerns\n+* It is assumed that node and master are secure and that compromising their security could also\n+  compromise secrets.\n+\n+## Use Cases\n+\n+1.  As a user, I want to store secret artifacts for my applications and consume them securely in\n+    pods, so that I can keep the configuration for my applications separate from the images that\n+    use them:\n+    1.  As a cluster operator, I want to allow a pod to access the Kubernetes master using a custom\n+        .kubeconfig, so that I can securely reach the master\n+    2.  As a cluster operator, I want to allow a pod to access the DockerHub using credentials from a\n+        .dockercfg file, so that pods can push images to the DockerHub\n+    3.  As a cluster operator, I want to allow a pod to access a GitHub repository using SSH keys, so\n+        that I can push and fetch to and from the repository\n+2.  As a user, I want to allow pods to consume supplemental information about services such as\n+    username and password which should be kept secret, so that I can share secrets about a service\n+    amongst the pods in my application securely\n+\n+### Use-Case: Configuration artifacts\n+\n+Many configuration files contain secrets intermixed with another configuration information.  For\n+example, a user's application may contain a properties file than contains database credentials,\n+SaaS API tokens, etc.  Users should be able to consume configuration artifacts in their pods and\n+be able to control the path on the containers filesystem where the artifact will be presented.\n+\n+### Use-Case: Metadata about services\n+\n+Most pieces of information about how to use a service are secrets.  For example, a service that\n+provides a mysql database needs to provide the username, password, and database name to consumers\n+so that they can authenticate and use the correct database. Pods consuming the mysql service would\n+also consume the secrets associated with the mysql service.\n+\n+## Consuming secrets as environment variables\n+\n+Some images will expect to receive configuration items as environment variables instead of files.\n+We should consider what the best way to allow this is; there are a few different options:\n+\n+1.  Force the user to adapt files into environment variables.  Users can store secrets that need to\n+    be presented as environment variables in a format that is easy to consume from a shell:\n+\n+        $ cat /etc/secrets/my-secret.txt\n+        export MY_SECRET_ENV=MY_SECRET_VALUE\n+\n+    The user could `source` the file at `/etc/secrets/my-secret` prior to executing the command for\n+    the image either inline in the command or in an init script, \n+\n+2.  Give secrets an attribute that allows users to express the intent that the platform should\n+    generate the above syntax in the file used to present a secret.  The user could consume these\n+    files in the same manner as the above option.\n+\n+3.  Give secrets attributes that allow the user to express that the secret should be presented to\n+    the container as an environment variable.  The container's environment would contain the\n+    desired values and the software in the container could use them without accomodation the\n+    command or setup script.\n+\n+**TODO**: Detailed assessment of the above options\n+\n+## Analysis TODOs\n+\n+Collecting remaining TODOs here:\n+\n+1.  Describe the lifecycle of secrets\n+2.  Determine how/whether secrets interact with service accounts; are namespaces enough for the\n+    security scope? Can/should my security context affect what secrets I have access to?\n+3.  How will pods know when secret values change?  Should there be a way to express that a pod\n+    which consumes a secret should be restarted when the secret changes?\n+\n+## Proposed Design\n+\n+### Overview\n+\n+This design proposes mounting secrets with a new volume type. The secrets volume will be backed\n+by a volume plugin that does the actual work of fetching the secret and placing it on the\n+filesystem to be mounted in the container. It should be possible to mount single files as part of a\n+secret. Secrets may consist of multiple files. For example, an SSH key pair. In order to remove the\n+burden from the end user in specifying every file that a secret consists of, it should be possible\n+to mount all files provided by a secret with a single ```VolumeMount``` entry in the container\n+specification.\n+\n+### Secret Volume Source\n+\n+A new Secret type of volume source will be added to the ```VolumeSource``` struct in the API:\n+\n+```go\n+type VolumeSource struct {\n+     ... \n+     Secret *Secret `json:\"secret\"`\n+}\n+\n+type Secret struct {\n+     // Ref is a reference to the actual secret\n+     Ref string \n+     \n+     // Files is a set of descriptors of where and how the secret files\n+     // should be placed (optional). If not specified, the secret itself\n+     // will determine where its files should go\n+\t Files []SecretFile\n+}\n+\n+type SecretFile struct {\n+     // Name of the file within the secret. For example, in the case\n+     // of SSH keys, you would have a 'private' and a 'public' key\n+\t Name string\n+\t \n+\t // Path of the secret within the container\n+\t Path string","path":"docs/design/secrets.md","position":125,"original_position":125,"commit_id":"2c3b33c35592e9fceaa2f7b71cb8ee8248c92ebd","original_commit_id":"2c3b33c35592e9fceaa2f7b71cb8ee8248c92ebd","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"body":"to clarify, is this a path relative to the mountpath of the secret volume","created_at":"2015-01-30T16:58:47Z","updated_at":"2015-01-30T16:58:47Z","html_url":"https://github.com/csrwng/kubernetes/pull/6#discussion_r23855048","pull_request_url":"https://api.github.com/repos/csrwng/kubernetes/pulls/6","_links":{"self":{"href":"https://api.github.com/repos/csrwng/kubernetes/pulls/comments/23855048"},"html":{"href":"https://github.com/csrwng/kubernetes/pull/6#discussion_r23855048"},"pull_request":{"href":"https://api.github.com/repos/csrwng/kubernetes/pulls/6"}}},"pull_request":{"url":"https://api.github.com/repos/csrwng/kubernetes/pulls/6","id":28318922,"html_url":"https://github.com/csrwng/kubernetes/pull/6","diff_url":"https://github.com/csrwng/kubernetes/pull/6.diff","patch_url":"https://github.com/csrwng/kubernetes/pull/6.patch","issue_url":"https://api.github.com/repos/csrwng/kubernetes/issues/6","number":6,"state":"open","locked":false,"title":"Secrets proposal","user":{"login":"csrwng","id":5834976,"avatar_url":"https://avatars.githubusercontent.com/u/5834976?v=3","gravatar_id":"","url":"https://api.github.com/users/csrwng","html_url":"https://github.com/csrwng","followers_url":"https://api.github.com/users/csrwng/followers","following_url":"https://api.github.com/users/csrwng/following{/other_user}","gists_url":"https://api.github.com/users/csrwng/gists{/gist_id}","starred_url":"https://api.github.com/users/csrwng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csrwng/subscriptions","organizations_url":"https://api.github.com/users/csrwng/orgs","repos_url":"https://api.github.com/users/csrwng/repos","events_url":"https://api.github.com/users/csrwng/events{/privacy}","received_events_url":"https://api.github.com/users/csrwng/received_events","type":"User","site_admin":false},"body":"","created_at":"2015-01-29T22:01:41Z","updated_at":"2015-01-30T16:58:47Z","closed_at":null,"merged_at":null,"merge_commit_sha":"5ce05145efab7b34a6221f38add0e2af57e24fe7","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/csrwng/kubernetes/pulls/6/commits","review_comments_url":"https://api.github.com/repos/csrwng/kubernetes/pulls/6/comments","review_comment_url":"https://api.github.com/repos/csrwng/kubernetes/pulls/comments/{number}","comments_url":"https://api.github.com/repos/csrwng/kubernetes/issues/6/comments","statuses_url":"https://api.github.com/repos/csrwng/kubernetes/statuses/2c3b33c35592e9fceaa2f7b71cb8ee8248c92ebd","head":{"label":"csrwng:secrets_proposal","ref":"secrets_proposal","sha":"2c3b33c35592e9fceaa2f7b71cb8ee8248c92ebd","user":{"login":"csrwng","id":5834976,"avatar_url":"https://avatars.githubusercontent.com/u/5834976?v=3","gravatar_id":"","url":"https://api.github.com/users/csrwng","html_url":"https://github.com/csrwng","followers_url":"https://api.github.com/users/csrwng/followers","following_url":"https://api.github.com/users/csrwng/following{/other_user}","gists_url":"https://api.github.com/users/csrwng/gists{/gist_id}","starred_url":"https://api.github.com/users/csrwng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csrwng/subscriptions","organizations_url":"https://api.github.com/users/csrwng/orgs","repos_url":"https://api.github.com/users/csrwng/repos","events_url":"https://api.github.com/users/csrwng/events{/privacy}","received_events_url":"https://api.github.com/users/csrwng/received_events","type":"User","site_admin":false},"repo":{"id":21752113,"name":"kubernetes","full_name":"csrwng/kubernetes","owner":{"login":"csrwng","id":5834976,"avatar_url":"https://avatars.githubusercontent.com/u/5834976?v=3","gravatar_id":"","url":"https://api.github.com/users/csrwng","html_url":"https://github.com/csrwng","followers_url":"https://api.github.com/users/csrwng/followers","following_url":"https://api.github.com/users/csrwng/following{/other_user}","gists_url":"https://api.github.com/users/csrwng/gists{/gist_id}","starred_url":"https://api.github.com/users/csrwng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csrwng/subscriptions","organizations_url":"https://api.github.com/users/csrwng/orgs","repos_url":"https://api.github.com/users/csrwng/repos","events_url":"https://api.github.com/users/csrwng/events{/privacy}","received_events_url":"https://api.github.com/users/csrwng/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/csrwng/kubernetes","description":"Container Cluster Manager","fork":true,"url":"https://api.github.com/repos/csrwng/kubernetes","forks_url":"https://api.github.com/repos/csrwng/kubernetes/forks","keys_url":"https://api.github.com/repos/csrwng/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/csrwng/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/csrwng/kubernetes/teams","hooks_url":"https://api.github.com/repos/csrwng/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/csrwng/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/csrwng/kubernetes/events","assignees_url":"https://api.github.com/repos/csrwng/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/csrwng/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/csrwng/kubernetes/tags","blobs_url":"https://api.github.com/repos/csrwng/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/csrwng/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/csrwng/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/csrwng/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/csrwng/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/csrwng/kubernetes/languages","stargazers_url":"https://api.github.com/repos/csrwng/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/csrwng/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/csrwng/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/csrwng/kubernetes/subscription","commits_url":"https://api.github.com/repos/csrwng/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/csrwng/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/csrwng/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/csrwng/kubernetes/issues/comments/{number}","contents_url":"https://api.github.com/repos/csrwng/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/csrwng/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/csrwng/kubernetes/merges","archive_url":"https://api.github.com/repos/csrwng/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/csrwng/kubernetes/downloads","issues_url":"https://api.github.com/repos/csrwng/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/csrwng/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/csrwng/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/csrwng/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/csrwng/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/csrwng/kubernetes/releases{/id}","created_at":"2014-07-11T21:33:52Z","updated_at":"2015-01-29T21:54:54Z","pushed_at":"2015-01-30T15:54:30Z","git_url":"git://github.com/csrwng/kubernetes.git","ssh_url":"git@github.com:csrwng/kubernetes.git","clone_url":"https://github.com/csrwng/kubernetes.git","svn_url":"https://github.com/csrwng/kubernetes","homepage":null,"size":25928,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":2,"forks":0,"open_issues":2,"watchers":0,"default_branch":"master"}},"base":{"label":"csrwng:master","ref":"master","sha":"7603f88960a557c7e769a47a1631a276599711ec","user":{"login":"csrwng","id":5834976,"avatar_url":"https://avatars.githubusercontent.com/u/5834976?v=3","gravatar_id":"","url":"https://api.github.com/users/csrwng","html_url":"https://github.com/csrwng","followers_url":"https://api.github.com/users/csrwng/followers","following_url":"https://api.github.com/users/csrwng/following{/other_user}","gists_url":"https://api.github.com/users/csrwng/gists{/gist_id}","starred_url":"https://api.github.com/users/csrwng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csrwng/subscriptions","organizations_url":"https://api.github.com/users/csrwng/orgs","repos_url":"https://api.github.com/users/csrwng/repos","events_url":"https://api.github.com/users/csrwng/events{/privacy}","received_events_url":"https://api.github.com/users/csrwng/received_events","type":"User","site_admin":false},"repo":{"id":21752113,"name":"kubernetes","full_name":"csrwng/kubernetes","owner":{"login":"csrwng","id":5834976,"avatar_url":"https://avatars.githubusercontent.com/u/5834976?v=3","gravatar_id":"","url":"https://api.github.com/users/csrwng","html_url":"https://github.com/csrwng","followers_url":"https://api.github.com/users/csrwng/followers","following_url":"https://api.github.com/users/csrwng/following{/other_user}","gists_url":"https://api.github.com/users/csrwng/gists{/gist_id}","starred_url":"https://api.github.com/users/csrwng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csrwng/subscriptions","organizations_url":"https://api.github.com/users/csrwng/orgs","repos_url":"https://api.github.com/users/csrwng/repos","events_url":"https://api.github.com/users/csrwng/events{/privacy}","received_events_url":"https://api.github.com/users/csrwng/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/csrwng/kubernetes","description":"Container Cluster Manager","fork":true,"url":"https://api.github.com/repos/csrwng/kubernetes","forks_url":"https://api.github.com/repos/csrwng/kubernetes/forks","keys_url":"https://api.github.com/repos/csrwng/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/csrwng/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/csrwng/kubernetes/teams","hooks_url":"https://api.github.com/repos/csrwng/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/csrwng/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/csrwng/kubernetes/events","assignees_url":"https://api.github.com/repos/csrwng/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/csrwng/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/csrwng/kubernetes/tags","blobs_url":"https://api.github.com/repos/csrwng/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/csrwng/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/csrwng/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/csrwng/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/csrwng/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/csrwng/kubernetes/languages","stargazers_url":"https://api.github.com/repos/csrwng/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/csrwng/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/csrwng/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/csrwng/kubernetes/subscription","commits_url":"https://api.github.com/repos/csrwng/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/csrwng/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/csrwng/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/csrwng/kubernetes/issues/comments/{number}","contents_url":"https://api.github.com/repos/csrwng/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/csrwng/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/csrwng/kubernetes/merges","archive_url":"https://api.github.com/repos/csrwng/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/csrwng/kubernetes/downloads","issues_url":"https://api.github.com/repos/csrwng/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/csrwng/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/csrwng/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/csrwng/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/csrwng/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/csrwng/kubernetes/releases{/id}","created_at":"2014-07-11T21:33:52Z","updated_at":"2015-01-29T21:54:54Z","pushed_at":"2015-01-30T15:54:30Z","git_url":"git://github.com/csrwng/kubernetes.git","ssh_url":"git@github.com:csrwng/kubernetes.git","clone_url":"https://github.com/csrwng/kubernetes.git","svn_url":"https://github.com/csrwng/kubernetes","homepage":null,"size":25928,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":2,"forks":0,"open_issues":2,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/csrwng/kubernetes/pulls/6"},"html":{"href":"https://github.com/csrwng/kubernetes/pull/6"},"issue":{"href":"https://api.github.com/repos/csrwng/kubernetes/issues/6"},"comments":{"href":"https://api.github.com/repos/csrwng/kubernetes/issues/6/comments"},"review_comments":{"href":"https://api.github.com/repos/csrwng/kubernetes/pulls/6/comments"},"review_comment":{"href":"https://api.github.com/repos/csrwng/kubernetes/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/csrwng/kubernetes/pulls/6/commits"},"statuses":{"href":"https://api.github.com/repos/csrwng/kubernetes/statuses/2c3b33c35592e9fceaa2f7b71cb8ee8248c92ebd"}}}}