flyteorg/flyte
[V2] Secret value is showing in pod spec ENVVAR directly
オープン
#7,824 opened on 2026/08/11
flyte2good first issuehelp wanted
Repository metrics
- Stars
- (3,705 個のスター)
- PR merge metrics
- (平均マージ 3d 8h) (30d で 114 merged PRs)
説明
Issue
When injecting a secret into task pod like this:
env = flyte.TaskEnvironment(
name="hello_world",
resources=flyte.Resources(cpu=1, memory="1Gi"),
image=image,
secrets=[
flyte.Secret(key="my_secret", as_env_var="MY_SECRET_KEY"),
]
)
When getting pod spec with kubectl describe command, we will directly see the secret value in ENVVAR, which is not secure:
Suggestion
We use webhook to inject secret into task pod. We should insert EnvVarSource instead of EnvVar value directly