Allow secret files

[lenianiva]

Would it be possible to allow authentication secrets to pass by file? For example, currently oidc-client-secret can only enter concourse via a flag or an environment variable. In some secret provisioning schemes, it is best to have concourse read this secret from a file.

The session signing key and TSA system already read keys from files.

[taylorsilva]

That's a reasonable ask. Would have the setup code check if the value passed into the existing fields is a file or not (use os.Stat() or something).

That said, not something I'll work on, but I'd be happy to merge a PR that does this.

[taylorsilva]

This might actually be a thing to update in dex: https://github.com/concourse/dex

[lenianiva]

I don't know enough Elm otherwise I would write a PR for this. Maybe I'll write it later. Currently my solution is to have encrypted environment files.

[taylorsilva]

No Elm! Elm is just the frontend, everything else is in Go. What're you asking about is all cluster configuration stuff, which is all handled by Go code.

Went looking again and I think changes would need to happen in this file: https://github.com/concourse/concourse/blob/master/skymarshal/skycmd/oidc_flags.go