[Users] Re: suggestion on managing secrets like aws-secret

Just FYI I created an issue so we can start this discussion with the community. Feel free to move that discussion to there or keep it here, while we update the issue. https://github.com/opendatahub-io/odh-manifests/issues/420 On Tue, May 4, 2021 at 11:40 AM Ke Zhu <kzhu(a)us.ibm.com&gt; wrote: > Thanks for the answer! > > If the suggestion is using k8s secret, it's fine, which means an admin > will need to provide required credentials via k8s manually or via > kustomize out of the ODH operator. > > What do you think about Hashicorp vault + its K8s Auth method? which > provides much better experience for managing secrets. > > On Tue, 2021-05-04 at 10:01 -0300, Ricardo Martinelli de Oliveira > wrote: > > Hello, You can control the secret name used in Trino deployment with > > the parameter "s3_credentials_secret". https://github.com/AICoE/idh- > > manifests/tree/production/trino#s3_credentials_secret You don't need > > to > > make kfctl/kustomize > > > > > > Hello, > > > > You can control the secret name used in Trino deployment with the > > parameter > > "s3_credentials_secret". > https://github.com/AICoE/idh-manifests/tree/production/trino#s3_credentia... > > > > You don't need to make kfctl/kustomize to control the credentials > > deployment, but you must specify the secret name that contains the > > right credentials in the parameters, otherwise Trino will use the > > default "aws_secret" secret that contains only hard-coded "changeme" > > values, which you don't want to use in a real environment. > > Unfortunately, that was the only method to parameterize the > > credentials in Trino and Data Catalog. > > > > Let me know if you have any other questions. > > > > On Tue, May 4, 2021 at 9:49 AM Ke Zhu <kzhu(a)us.ibm.com&gt; wrote: > > > I'm trying to adopt the opendatahub/kubeflow operator with > > > kustomize > > > to > > > provisioning components like Hive/Trino, but one common requirement > > > for > > > running production system is credential management. > > > > > > what's the general suggestion on managing credentials required by > > > opendatahub? k8s secrets? > > > > > > For example: > > > > https://github.com/opendatahub-io/odh-manifests/blob/master/trino/base/aw... > > > > > > I'd prefer not to manage credential in code via kustomize. It's ok > > > by > > > using environment variable plus kustomize secret generator, but it > > > won't work if it's the operator pull then provisioning the > > > opendatahub > > > via kfctl/kustomize. > > > _______________________________________________ > > > Users mailing list -- users(a)lists.opendatahub.io > > > To unsubscribe send an email to users-leave(a)lists.opendatahub.io > > > > > > -- Ricardo Martinelli De Oliveira Senior Software Engineer, AI CoE Red Hat Brazil <https://www.redhat.com/> Av. Brigadeiro Faria Lima, 3900 8th floor rmartine(a)redhat.com T: +551135426125 M: +5511970696531 @redhatjobs <https://twitter.com/redhatjobs> redhatjobs <https://www.facebook.com/redhatjobs> @redhatjobs <https://instagram.com/redhatjobs> <https://www.redhat.com/> _______________________________________________ Users mailing list -- users(a)lists.opendatahub.io To unsubscribe send an email to users-leave(a)lists.opendatahub.io