engineyard / kubernetes-workshop Goto Github PK

02-secrets-environment-variables.md

Your guide recommends exposing Secrets as deployment configuration values, stored in the clear on the deployments, as well as injected into the running container's ENV. This is a violation of security practices and defeats the the purpose of using Secrets altogether. Please update your docs to either advise that this practice puts application and environment security at risk, or update your practices and approach to follow k8s best practices and the protection of secrets.

04-dockerize-rails-for-kubernetes.md

This guide advises an approach that requires a database connection in order to build the Docker container. This means that the Docker build environment must be able to resolve and communicate with a database. If this is intended, it is best to use ARG and allow the user to specify the hostname of the DB by --build-arg. However, the best practice would be to avoid this requirement altogether and have your asset pipeline detached from DB dependencies (directly using webpack is good way to do that). The advised approach is brittle in CI/CD environments and can cause additional headaches when attempting to have Docker build as part of Pipeline builders. Please update your docs to reflect the risks of the recommended approach, or revise your recommendations.