|
| 1 | +# Sentrius Secret Management |
| 2 | + |
| 3 | +## Overview |
| 4 | + |
| 5 | +Hardcoded secrets have been removed from the Helm charts and application properties files. The system now supports both dynamic secret generation and external secret management. |
| 6 | + |
| 7 | +## Dynamic Secret Generation |
| 8 | + |
| 9 | +When no secrets are provided in values.yaml, the Helm charts will automatically generate random secrets for: |
| 10 | + |
| 11 | +- OAuth2 client secrets (32 characters) |
| 12 | +- Database passwords (32 characters) |
| 13 | +- Keystore passwords (24 characters) |
| 14 | +- Keycloak admin passwords (24 characters) |
| 15 | +- Neo4j authentication strings (16 character passwords) |
| 16 | + |
| 17 | +## Providing Custom Secrets |
| 18 | + |
| 19 | +You can override the generated secrets by setting them in your values.yaml: |
| 20 | + |
| 21 | +```yaml |
| 22 | +# Example custom secrets |
| 23 | +secrets: |
| 24 | + db: |
| 25 | + username: "my-db-user" |
| 26 | + password: "my-secure-password" |
| 27 | + keystorePassword: "my-keystore-password" |
| 28 | + |
| 29 | +sentrius: |
| 30 | + oauth2: |
| 31 | + client_secret: "my-oauth2-secret" |
| 32 | + |
| 33 | +keycloak: |
| 34 | + adminPassword: "my-keycloak-admin-password" |
| 35 | + clientSecret: "my-keycloak-client-secret" |
| 36 | + db: |
| 37 | + password: "my-keycloak-db-password" |
| 38 | + |
| 39 | +neo4j: |
| 40 | + env: |
| 41 | + NEO4J_AUTH: "neo4j/my-neo4j-password" |
| 42 | +``` |
| 43 | +
|
| 44 | +## Environment Variables |
| 45 | +
|
| 46 | +Application properties files now use environment variables with fallback defaults: |
| 47 | +
|
| 48 | +- `KEYCLOAK_CLIENT_SECRET` - OAuth2 client secret for Keycloak |
| 49 | +- `DATABASE_PASSWORD` - Database password (defaults to "password") |
| 50 | +- `KEYSTORE_PASSWORD` - Keystore password (defaults to "keystorepassword") |
| 51 | + |
| 52 | +## Production Deployment |
| 53 | + |
| 54 | +For production environments, it is recommended to: |
| 55 | + |
| 56 | +1. Use an external secret management system (HashiCorp Vault, AWS Secrets Manager, etc.) |
| 57 | +2. Set all secrets explicitly in your values.yaml file |
| 58 | +3. Use Kubernetes secrets or external secret operators |
| 59 | +4. Never commit secrets to version control |
| 60 | + |
| 61 | +## Removed Hardcoded Secrets |
| 62 | + |
| 63 | +The following hardcoded secrets were removed: |
| 64 | + |
| 65 | +- `nGkEukexSWTvDzYjSkDmeUlM0FJ5Jhh0` (multiple OAuth2 client secrets) |
| 66 | +- `e4WgJovH8MzcAvRnFg3rROAbeDIwiYmx` (agent client secret) |
| 67 | +- `KLJMLKSDJGlkj23@#jasdlkjg@#dsagsagdsag` (AI agent client secret) |
| 68 | +- `neo4j/testingsecret` (Neo4j authentication) |
| 69 | +- Base64 encoded database credentials |
| 70 | +- Hardcoded keystore passwords |
0 commit comments