Best practices for storing passwords when using Spring Boot-CodePudding

We are working on a Java Spring Boot application, that needs access to a database, the password is stored on the application.properties file.

Our main issue is that the passwords might be viewable when uploaded to GitLab/GitHub.

I found that we can use Jasypt to encrypt the data, but from what I read, I need to use the decryption key on the execution, which is also stored on Git, in order to be deployed using Kubernates.

Is there some way to secure our passwords in such a case? We are using AWS if that makes any difference, and we are trying to use the EKS service, but until now we have had a VM with K8s installed.

CodePudding user response：

Do not store passwords in application.properties as you mention is insecure but also you may have a different version of your application (dev, staging, prod) which will use different databases and different passwords.

What you can do in this case is maintain the password empty in source files and externalize this configuration, i.e you can use an environment variable in your k8 deployment file or VM that the application will be run, spring boot will load it as property value if they have the right format. From spring documentation:

Spring Boot lets you externalize your configuration so that you can work with the same application code in different environments. You can use a variety of external configuration sources, include Java properties files, YAML files, environment variables, and command-line arguments.

CodePudding user response：

You should use environment variables in your application.properties file for this:

spring.datasource.username=${SPRING_DATASOURCE_USERNAME}
spring.datasource.password=${SPRING_DATASOURCE_PASSWORD}

Or with a default value (for development):

spring.datasource.username=${SPRING_DATASOURCE_USERNAME:admin}
spring.datasource.password=${SPRING_DATASOURCE_PASSWORD:admin}

Then you can add a Kubernetes Secret to your namespace:

apiVersion: v1
kind: Secret
metadata:
  name: mysecret
  namespace: mynamespace
data:
  SPRING_DATASOURCE_PASSWORD: YWRtaW4=
  SPRING_DATASOURCE_USERNAME: YWRtaW4=

And assign it to your Deployment:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mydeployment
spec:
  # omitted...
      containers:
      - name: mycontainer
        envFrom:
        - secretRef:
            name: mysecret
        - configMapRef:
            name: myconfigmap
  # omitted...

Another alternative would be to store the entire application.properties file in your Secret or ConfigMap and mount it into your container as a file.

Both scenarios are explained in further detail here: https://developers.redhat.com/blog/2017/10/03/configuring-spring-boot-kubernetes-configmap