OIDC client-secret gets passed to the proxy as a cli argument even if set as a Secret about proxyinjector HOT 3 OPEN

Ping for this issue. If the proposed solution seems usable, I can start to work on a PR.
Otherwise, I'm happy to help with changing the Patching method in a way that solves this issue

from proxyinjector.

@PastNullInfinity Thank you for opening an issue. Does gatekeeper provides support to get the secrets from Environment variables instead of cli? If yes, then we can just set them and this can be resolved.

from proxyinjector.

@PastNullInfinity Thank you for opening an issue. Does gatekeeper provides support to get the secrets from Environment variables instead of cli? If yes, then we can just set them and this can be resolved.

Unfortunately not, only through cli flags or via the config.yaml.

For now I have a (admittedly, pretty hacky) workaround: I've made a new dockerfile for gatekeeper that passes $CLIENT_SECRET as a flag to gatekeeper, and then I've modified the patch that ProxyInjector applies in order to also add an env: declaration with a reference to a Secret containing the key.

As far as I can tell, there's no easy way to set the secret without mounting it as a file (so a volumeMount), or by editing the dockerfile itself.

I realize also that adding a volume would mean to change quite a bit of the current patch method, since it only cares for the container spec right now.

from proxyinjector.