Skip to content

chore(security): make TLS cert/key placeholders obvious for secret scanning #183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kriscoleman merged 1 commit into from
Jun 22, 2026
Merged

chore(security): make TLS cert/key placeholders obvious for secret scanning #183

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions applications/mlflow/charts/mlflow/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -835,7 +835,7 @@ When making changes to the MLflow Helm chart, corresponding updates may be neede
| mlflow.image.repository | string | `"mlflow/mlflow"` | Image repository |
| mlflow.image.tag | string | `"v3.3.2"` | Image tag |
| mlflow.imagePullSecets | list | `[]` | Image pull secrets |
| mlflow.ingress | object | `{"annotations":{},"className":"nginx","enabled":false,"extraHosts":[],"extraPaths":[],"extraRules":[],"extraTls":[],"hostname":"chart-example.local","path":"/","pathType":"ImplementationSpecific","tls":{"cert":"-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----\n","enabled":false,"genSelfSignedCert":false,"key":"-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----\n"}}` | Mlflow Ingress configuration [[ref]](https://kubernetes.io/docs/concepts/services-networking/ingress/) |
| mlflow.ingress | object | `{"annotations":{},"className":"nginx","enabled":false,"extraHosts":[],"extraPaths":[],"extraRules":[],"extraTls":[],"hostname":"chart-example.local","path":"/","pathType":"ImplementationSpecific","tls":{"cert":"REPLACE_WITH_YOUR_PEM_ENCODED_TLS_CERTIFICATE","enabled":false,"genSelfSignedCert":false,"key":"REPLACE_WITH_YOUR_PEM_ENCODED_TLS_PRIVATE_KEY"}}` | Mlflow Ingress configuration [[ref]](https://kubernetes.io/docs/concepts/services-networking/ingress/) |
| mlflow.ingress.annotations | object | `{}` | Annotations to add to the ingress |
| mlflow.ingress.className | string | `"nginx"` | Ingress class name |
| mlflow.ingress.enabled | bool | `false` | Specifies whether a ingress should be created |
Expand All @@ -846,7 +846,7 @@ When making changes to the MLflow Helm chart, corresponding updates may be neede
| mlflow.ingress.hostname | string | `"chart-example.local"` | Ingress hostname |
| mlflow.ingress.path | string | `"/"` | Ingress path |
| mlflow.ingress.pathType | string | `"ImplementationSpecific"` | Ingress path type |
| mlflow.ingress.tls | object | `{"cert":"-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----\n","enabled":false,"genSelfSignedCert":false,"key":"-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----\n"}` | Ingress TLS configuration |
| mlflow.ingress.tls | object | `{"cert":"REPLACE_WITH_YOUR_PEM_ENCODED_TLS_CERTIFICATE","enabled":false,"genSelfSignedCert":false,"key":"REPLACE_WITH_YOUR_PEM_ENCODED_TLS_PRIVATE_KEY"}` | Ingress TLS configuration |
| mlflow.ingress.tls.enabled | bool | `false` | Specifies whether to enable TLS |
| mlflow.ingress.tls.genSelfSignedCert | bool | `false` | Specifies whether to generate self-signed certificate |
| mlflow.labels | object | `{}` | Labels to add to the mlflow deployment |
Expand Down
12 changes: 6 additions & 6 deletions applications/mlflow/charts/mlflow/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,12 +220,12 @@ mlflow:
enabled: false
# -- Specifies whether to generate self-signed certificate
genSelfSignedCert: false
cert: |
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
key: |
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
# -- PEM-encoded TLS certificate. Replace the placeholder with your real
# certificate (or set genSelfSignedCert: true to generate one).
cert: "REPLACE_WITH_YOUR_PEM_ENCODED_TLS_CERTIFICATE"
# -- PEM-encoded TLS private key. Replace the placeholder with your real key
# (or set genSelfSignedCert: true to generate one).
key: "REPLACE_WITH_YOUR_PEM_ENCODED_TLS_PRIVATE_KEY"
# -- Extra hosts to configure for the ingress object
extraHosts: []
# -- Extra paths to configure for the ingress object
Expand Down
10 changes: 4 additions & 6 deletions patterns/self-signed-vs-user-provided-tls/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,12 +14,10 @@ ingress:
tls:
enabled: true
genSelfSignedCert: true
cert: |
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
key: |
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
# Replace the placeholders with your real PEM-encoded cert/key, or set
# genSelfSignedCert: true to have them generated and omit these.
cert: "REPLACE_WITH_YOUR_PEM_ENCODED_TLS_CERTIFICATE"
key: "REPLACE_WITH_YOUR_PEM_ENCODED_TLS_PRIVATE_KEY"
```

2. Add a tls secret to your chart and implement the templating to conditionally choose between user-provided and self-signed
Expand Down
Loading