flyteorg/flyte

[V2] Secret value is showing in pod spec ENVVAR directly

开放

#7,824 创建于 2026年8月11日

 (2 条评论) (0 个反应) (1 位负责人)Python (378 个派生)batch import
flyte2good first issuehelp wanted

仓库指标

星标
 (3,705 个星标)
PR 合并指标
 (平均合并 3天 8小时) (30 天内合并 114 个 PR)

描述

Issue

When injecting a secret into task pod like this:

env = flyte.TaskEnvironment(
    name="hello_world",
    resources=flyte.Resources(cpu=1, memory="1Gi"),
    image=image,
    secrets=[
        flyte.Secret(key="my_secret", as_env_var="MY_SECRET_KEY"),
    ]
)

When getting pod spec with kubectl describe command, we will directly see the secret value in ENVVAR, which is not secure:

Suggestion

We use webhook to inject secret into task pod. We should insert EnvVarSource instead of EnvVar value directly

贡献者指南