[Feature Request] Use a Kubernetes secret to protect the OIDC client secret

[srikanthchelluri]

Ideally, when we configure authentication to Temporal Web, we shouldn't pass the plaintext client secret as a Helm value but instead pass the name of the Kubernetes Secret which contains the client secret.

Right now, all of .Values.web.config is simply just dumped into a ConfigMap [1] then mounted to the Deployment [2]. Temporal Web reads from this configuration file [3].

Some initial ideas:

• Maybe we should be able to create a Kubernetes Secret separately that contains the entire configuration file and pass its name as a Helm value. Then we can mount the Secret in the web Deployment.
• We could possibly also just put the client secret in the Kubernetes secret (as opposed to the entire configuration file) though I haven't thought through exactly how that'd look in terms of templates.

[1] https://github.com/temporalio/helm-charts/blob/master/templates/web-configmap.yaml
[2] https://github.com/temporalio/helm-charts/blob/master/templates/web-deployment.yaml
[3] https://github.com/temporalio/web/blob/master/server/auth/index.js

[Davidonium]

I think this would be good to have as I've been trying to set up SSO for a fresh temporal installation using the chart.

IMO the easiest would be for the client_secret to be an env var that could be injected from a secret. That'd require changes in the web codebase though.

[Davidonium]

After some digging I found out that the temporalio/ui docker image dockerizes the configuration file before running. So the {{ .Env.TEMPORAL_* }} syntax can be used in the helm chart to achieve passing the client secret as a proper env var injected from a k8s secret.

[peter-c-larsson]

Thanks for that information @Davidonium . Will try that approach will waiting for this issue to get attention.

[enricojonas]

@debugger24 I tried this but it's not working and found out that it's not released yet. Is it possible to release it? It improves security a lot.

Thank you

[robholland]

This was implemented in #603 which has since been released.