Audit of final cf-for-k8s deployment

audit-k8s-config.md

Findings

• cf-api-kpack-watcher deployment uses admin_client_secret non secret
• cloud-controller-ng-yaml configmap consumes postgres password
• cloud-controller-ng-yaml is just a huge yaml dump. can this be broken down into key-value config map
• cloud-controller-ng-yaml bunch of other secrets that are unused but still in the configmap
• cloud-controller-ng-yaml configmap consumes blobstore password
• cloud-controller-ng-yaml configmap consumes uaa password as plain text cloud_controller_username_lookup_client_secret
• eirini config-map consumes secret name app-registry-credentials as config yaml (instead of secret).
• Will kapp rotate CRDs that reference secret names e.g. Gateway.istio-ingressgateway.credentialName
• uaa-config config map consumes encryption.encryption_keys.passphrase
• uaa-config config map consumes certs directly serviceProviderKey, serviceProviderKeyPassword, serviceProviderCertificate
• uaa-config config map consumes LOGIN_SECRET: uaa-login-secret instead of mounted path
• uaa-config config map consumes client secrets as plain text cf-k8s-networking, cloud_controller_username_lookup, capi_kpack_watcher
• uaa-config config map consumes cf_admin_password from values.yml as plain text
• cf-for-k8s is using the same uaa admin passwords for components. instead, it should use separate passwords for each client.