Kubeconfig creator task accepts secrets as parameters

[afrittoli]

Expected Behavior

Tasks never accept secrets as parameters. A workspace (or a secret name) and field names can be used to provide access to secrets stored as k8s secrets or as files on a volume.

Actual Behavior

The kubeconfig creator tasks https://hub.tekton.dev/tekton/task/kubeconfig-creator accepts several secrets as parameters. This is an issue because there's no way to avoid secrets being exposed if they are passed as parameters to a task.
The value of those parameters will be stored in etcd, accessible via the CLI/dashboard (even in readonly mode) and might even be sent in cloud events notifications when they are enabled.

[afrittoli]

/cc @divyansh42

[afrittoli]

FYI @psschwei

[afrittoli]

As noted by @sm43, our kubeconfigwriter image does not include bash, and it only accepts its input as an inline json.

I think there are a couple of alternatives we could adopt:

• add an alternative input param to the kubeconfigwriter command, that takes a filename where the params are written
• add bash to the base image used for kubeconfigwriter

/cc @vdemeester

[vdemeester]

Maybe both are possible even 😛 .

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[tekton-robot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle rotten

Send feedback to tektoncd/plumbing.

[tekton-robot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

[tekton-robot]

@tekton-robot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[afrittoli]

/lifecycle frozen

[vinamra28]

@afrittoli @dibyom @vdemeester do we still want this? 😅
with removal of PipelineResources and their corresponding images, do we want to maintain this task and it's respective image?