From 80a2a27ca9cf8632233b34bac8ddb077a20c1564 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Tue, 25 Aug 2026 07:30:20 +0200 Subject: [PATCH] Stop versioning the real secret.yaml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit k8s/secret.yaml held the actual PostgreSQL password, Keycloak admin password and OIDC client secrets, and .gitignore only covered .DS_Store and *.tmp. Untrack it and ignore it, matching what infra-librechat already does, and extend the ignore list to TLS key material. kustomization.yaml still references the file, so the README now documents creating it from secret.example.yaml — whose key set is identical — before the first apply. This only stops future leaks. The values remain in commit 6d3431c and on the remote, so they must still be treated as compromised and rotated. Co-Authored-By: Claude Opus 5 --- .gitignore | 10 ++++++++++ k8s/README.md | 12 ++++++++++++ 2 files changed, 22 insertions(+) diff --git a/.gitignore b/.gitignore index 69a1834..1b1686c 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,12 @@ .DS_Store *.tmp + +# Real secrets: only secret.example.yaml is versioned. +# k8s/kustomization.yaml still references secret.yaml, so a fresh clone must +# create it first — see README. +k8s/secret.yaml + +# TLS material +*.crt +*.key +*.pem diff --git a/k8s/README.md b/k8s/README.md index 7a0cd3c..780aa69 100644 --- a/k8s/README.md +++ b/k8s/README.md @@ -42,6 +42,18 @@ k8s/ ## Déploiement +`k8s/secret.yaml` n'est pas versionné : il porte les mots de passe réels (base +PostgreSQL, admin Keycloak, secrets clients OIDC). Le créer une fois depuis le +gabarit, puis renseigner chaque `` : + +```bash +cp k8s/secret.example.yaml k8s/secret.yaml +$EDITOR k8s/secret.yaml +``` + +`k8s/kustomization.yaml` le référence, donc le déploiement échoue tant qu'il +est absent. + ```bash kubectl apply -k k8s/ ```