-
-
Notifications
You must be signed in to change notification settings - Fork 103
Open
Description
-
Admin token is enabled by default with a known value.
values.yamlsetsadminToken.valueto a fixed Argon2 hash, and_podSpec.tplalways injectsADMIN_TOKENwhen.Values.adminTokenisnon-nil. This means a fresh install enables the admin page with a token derived from a known example value. That’s a security risk. -
adminToken=nullcan break rendering.
The README suggests--set adminToken=nullto disable the admin token, butsecrets.yamlstill does b64enc on.Values.adminToken.value. IfadminTokenis null, that can error during template render.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels