The controller reads its credentials from files; every other env-file secret says why #31

Merged

jschoubben merged 2 commits from feat/secret-not-in-environment into main

2026-09-21 09:59:08 +00:00

Author	SHA1	Message	Date
jschoubben	8647ea6671	The control plane's secret files belong to its own account (secrets-owner)	2026-09-21 10:19:00 +02:00
jschoubben	32dec5f0c2	The controller reads its credentials from files; every other env-file secret says why ADR 0086. mesh-controller mounts its six own secrets and names them with _FILE twins, so no credential of its own reaches its environment. The 35 containers that still read a secret through an env-file carry secrets-in-environment with the reason; converting each where its software accepts a path is the per-module work of issue 041.	2026-09-21 10:10:33 +02:00

Author

SHA1

Message

Date

jschoubben

8647ea6671

The control plane's secret files belong to its own account (secrets-owner)

2026-09-21 10:19:00 +02:00

jschoubben

32dec5f0c2

The controller reads its credentials from files; every other env-file secret says why

ADR 0086. mesh-controller mounts its six own secrets and names them with
_FILE twins, so no credential of its own reaches its environment. The 35
containers that still read a secret through an env-file carry
secrets-in-environment with the reason; converting each where its software
accepts a path is the per-module work of issue 041.

2026-09-21 10:10:33 +02:00