DongHyeonkaandClaude Opus 5
027c24ee27
Every secret in the lab prints in four commands, while kubectl describe shows just a byte count and creates the impression that something is hidden. k3s reports encryption at rest disabled and the plaintext password is present in state.db, so one node disk carries the whole cluster's secrets, and inside the pod they are ordinary environment variables visible to exec, /proc and crash dumps. The default service account cannot read secrets, which makes RBAC the one control doing real work here and the thing worth tightening. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
18 lines
710 B
Plaintext
18 lines
710 B
Plaintext
=== 실험대의 Secret 목록 ===
|
|
bff-secrets Opaque keys=1
|
|
keycloak-lab-secrets Opaque keys=2
|
|
oauth2-proxy-secrets Opaque keys=3
|
|
|
|
=== ★ base64 는 암호화가 아니다 — 한 줄로 읽힌다 ===
|
|
keycloak-lab-secrets/POSTGRES_PASSWORD = lab-postgres-change-me
|
|
keycloak-lab-secrets/KC_BOOTSTRAP_ADMIN_PASSWORD = lab-admin-change-me
|
|
bff-secrets/KEYCLOAK_CLIENT_SECRET = bff-lab-secret
|
|
oauth2-proxy-secrets/COOKIE_SECRET_A = lab-cookie-secret-aaaaaaaaaaaaaa
|
|
|
|
=== describe 는 값을 감춘다 (그래서 안전하다고 착각한다) ===
|
|
Type: Opaque
|
|
|
|
Data
|
|
====
|
|
KEYCLOAK_CLIENT_SECRET: 14 bytes
|