Hi,
It can depend on which deployment option you plan to use for the application.
For instance, a Docker deployment orchestrated by Kubernetes gives the option of using secrets for sensitive information, which a hoster such as GCP manages conveniently. In this kind of deployment, configuration (and secrets) are passed to the app as environment variables, on which Kubernetes configuration maps and secrets are mapped to. Thanks to this, values are stored nowhere in the app code, companion files or database.
Regards
Eric
Hi Eric,
Thanks for the response.
This idea has an end goal of being deployed in a resilient way so most probably docker with some form of orchestration, Docker swarm or Kubernetes.
The credentials are mainly stored in a .env file at the moment and could be added to the secrets but I need for people who are admins for a particular cloud to add their cloud details to the app and then store their credentials securely.
Unfortunately this will need a dynamic storage mechanism which i
don't know how to do yet
Regards
Lance
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/VI1P193MB043243D0747282C2D96F60E38CC00%40VI1P193MB0432.EURP193.PROD.OUTLOOK.COM.
Hi Lance,
but I need for people who are
admins for a particular cloud to add their cloud details to the app and then store their credentials securely.
I'm not sure to understand the need for adding cloud details to the app for the admins.
The suggestion I made assumed that sensitive information is managed as K8S secrets. As long as the admins have GCloud (for instance) credentials set (which are stored and managed at GCloud level), they can administrate
the secrets resources by "applying" the corresponding YAML descriptors remotely from their workstation. The sensitive values are thus stored nowhere inside the application itself, but passed to the containers at runtime as environment variables.
Maybe I've misunderstood your need and sorry in this case if my answer is off topic.
Best
Eric
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/VI1P193MB0432916809AFE450553011D98CC10%40VI1P193MB0432.EURP193.PROD.OUTLOOK.COM.
Hi Eric,
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/VI1P193MB0432916809AFE450553011D98CC10%40VI1P193MB0432.EURP193.PROD.OUTLOOK.COM.
Hi Mike,
Thank you for taking the time to read this.
I have highlighted these sentences in your response
The bottom line question: What is lost if temporary creds are
compromised?
The credentials have high level access to the backed system think e.g kubernetes admin so compromise would mean full access to kubernetes to add remove delete anything.
What plan do you have to execute to recover from the feared event when/if it happens?
This is a valid question, The recovery for these would be rebuild of a cluster or service. depending on the damage caused.
It seems my idea of making these options configurable via a web UI will not easily be done.
I will have to stay with the current deployment plan.
Thanks
Lance
Hi Lance,
Well, I was off topic. Sorry for this :/ I understand your need better now.
There are chances you've already thought to this option, but what about storing the sensitive data encrypted with a key based on a passphrase the user must provide when logging, in addition to the usual credentials ? This passphrase would not be stored anywhere, so even if the DB is compromised, the sensitive data would not be usable.
Eric
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/VI1P193MB04323838756D4FC42BD744728CC10%40VI1P193MB0432.EURP193.PROD.OUTLOOK.COM.
Thanks I will take a look at that
Lance
--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users...@googlegroups.com.
To post to this group, send email to django...@googlegroups.com.
Visit this group at https://groups.google.com/group/django-users.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/df4e7fc2-cf4d-4742-9fd3-adc1e7d037c6%40googlegroups.com.
Thanks Eric,
I did not explain myself properly so the mistake was mine.
Thanks for the help.
Lance
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/VI1P193MB04323838756D4FC42BD744728CC10%40VI1P193MB0432.EURP193.PROD.OUTLOOK.COM.
Hi Dev,
I believe that it would not provide much more security around the details.
Thank you for responding.
Regards
Lance
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CALZ%3DbEKYs7TkjPPbSfB5ogXyGUbswgRkju8%3DitEgu_%2B9cSRD-A%40mail.gmail.com.