From 17d5aafa1f2a1ecef15dbeba856a6d07f1eafdf1 Mon Sep 17 00:00:00 2001 From: wbsong111 Date: Mon, 24 Aug 2026 10:21:42 +0900 Subject: [PATCH] =?UTF-8?q?=EC=BB=A4=EB=B0=8B=EB=90=9C=20=EC=9E=90?= =?UTF-8?q?=EA=B2=A9=EC=A6=9D=EB=AA=85=EC=9D=84=20=EC=98=88=EC=8B=9C=20?= =?UTF-8?q?=EA=B0=92=EC=9C=BC=EB=A1=9C=20=EA=B5=90=EC=B2=B4=ED=95=9C?= =?UTF-8?q?=EB=8B=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit nemo 의 NGC API 키와, airflow git-sync · gitea · keycloakx 가 공유하던 암호가 평문으로 커밋돼 있었다. airflow 쪽은 같은 값을 base64 로 감싼 것이라 5개 파일을 함께 교체했다. 4개 차트 helm template 렌더 확인. 히스토리와 GitHub PR ref 에는 남으므로 키 로테이션이 별도로 필요하다. Co-Authored-By: Claude Opus 5 (1M context) --- manifests/helm/airflow/1.16.0/CUSTOM-README.md | 7 +++++-- manifests/helm/airflow/1.16.0/custom-values.yaml | 7 +++++-- manifests/helm/gitea/12.4.0/test-values.yaml | 6 +++--- manifests/helm/keycloakx/7.2.2/CUSTOM-README.md | 2 +- manifests/helm/keycloakx/7.2.2/custom-values.yaml | 2 +- manifests/helm/nemo/25.4.0/custom-values.yaml | 6 ++++-- 6 files changed, 19 insertions(+), 11 deletions(-) diff --git a/manifests/helm/airflow/1.16.0/CUSTOM-README.md b/manifests/helm/airflow/1.16.0/CUSTOM-README.md index b596a38..130019d 100644 --- a/manifests/helm/airflow/1.16.0/CUSTOM-README.md +++ b/manifests/helm/airflow/1.16.0/CUSTOM-README.md @@ -50,13 +50,16 @@ helm upgrade airflow ./ -f custom-values.yaml --install -n airflow --create-nam # git 리포지토리의 clone 및 pull 실행 시 사용할 username, password 설정. # 실행하는 git 이미지의 버전은 v3, v4 2가지가 있고 사용하는 환경변수가 다름. # 2가지 설정을 하지 않을 시 동작 에러 발생. + # 값은 base64 다. 아래는 예시 값이므로 배포 전 실제 git 계정 값으로 교체한다 + # (Q2hhbmdlTWUxMjM0IQ== = "ChangeMe1234!", 생성: printf '<암호>' | base64). + # 실제 암호를 카탈로그에 적어 커밋하지 않는다. extraSecrets: git-credentials: data: | GIT_SYNC_USERNAME: c3Vkb3VzZXI= GITSYNC_USERNAME: c3Vkb3VzZXI= - GIT_SYNC_PASSWORD: UGFhc2FkbTEyMzQh - GITSYNC_PASSWORD: UGFhc2FkbTEyMzQh + GIT_SYNC_PASSWORD: Q2hhbmdlTWUxMjM0IQ== + GITSYNC_PASSWORD: Q2hhbmdlTWUxMjM0IQ== ``` diff --git a/manifests/helm/airflow/1.16.0/custom-values.yaml b/manifests/helm/airflow/1.16.0/custom-values.yaml index 565ba60..c980554 100644 --- a/manifests/helm/airflow/1.16.0/custom-values.yaml +++ b/manifests/helm/airflow/1.16.0/custom-values.yaml @@ -59,13 +59,16 @@ dags: value: "true" +# 아래 자격증명은 예시 값이다(base64). 배포 전 실제 git 계정 값으로 교체한다. +# Q2hhbmdlTWUxMjM0IQ== = "ChangeMe1234!" · 생성: printf '<암호>' | base64 +# 실제 암호를 이 파일에 적어 커밋하지 않는다. extraSecrets: git-credentials: data: | GIT_SYNC_USERNAME: c3Vkb3VzZXI= - GIT_SYNC_PASSWORD: UGFhc2FkbTEyMzQh + GIT_SYNC_PASSWORD: Q2hhbmdlTWUxMjM0IQ== GITSYNC_USERNAME: c3Vkb3VzZXI= - GITSYNC_PASSWORD: UGFhc2FkbTEyMzQh + GITSYNC_PASSWORD: Q2hhbmdlTWUxMjM0IQ== webserver: defaultUser: diff --git a/manifests/helm/gitea/12.4.0/test-values.yaml b/manifests/helm/gitea/12.4.0/test-values.yaml index c9f160d..9b29bf2 100644 --- a/manifests/helm/gitea/12.4.0/test-values.yaml +++ b/manifests/helm/gitea/12.4.0/test-values.yaml @@ -52,7 +52,7 @@ persistence: gitea: admin: username: sudouser - password: Paasadm1234! + password: ChangeMe1234! email: "sudouser@cro.com" config: APP_NAME: paasup git @@ -64,13 +64,13 @@ gitea: HOST: postgresql-postgresql-ha-postgresql:5432 NAME: gitea USER: gitea - PASSWD: Paasadm1234! + PASSWD: ChangeMe1234! CHARSET: utf8 SCHEMA: gitea SSL_MODE: disable session: PROVIDER: postgres - PROVIDER_CONFIG: user=gitea password=Paasadm1234! host=postgresql-postgresql-ha-postgresql port=5432 dbname=gitea_session sslmode=disable + PROVIDER_CONFIG: user=gitea password=ChangeMe1234! host=postgresql-postgresql-ha-postgresql port=5432 dbname=gitea_session sslmode=disable COOKIE_NAME: i_hate_gitea service: DEFAULT_ALLOW_CREATE_ORGANIZATION: true diff --git a/manifests/helm/keycloakx/7.2.2/CUSTOM-README.md b/manifests/helm/keycloakx/7.2.2/CUSTOM-README.md index b131029..284fc56 100644 --- a/manifests/helm/keycloakx/7.2.2/CUSTOM-README.md +++ b/manifests/helm/keycloakx/7.2.2/CUSTOM-README.md @@ -50,7 +50,7 @@ extraEnv: | - name: KC_BOOTSTRAP_ADMIN_USERNAME value: admin - name: KC_BOOTSTRAP_ADMIN_PASSWORD - value: Paasadm1234! + value: ChangeMe1234! # 예시 값 — 배포 전 교체한다 - name: TZ value: Asia/Seoul ``` diff --git a/manifests/helm/keycloakx/7.2.2/custom-values.yaml b/manifests/helm/keycloakx/7.2.2/custom-values.yaml index 0a3d3f1..ca3be81 100644 --- a/manifests/helm/keycloakx/7.2.2/custom-values.yaml +++ b/manifests/helm/keycloakx/7.2.2/custom-values.yaml @@ -75,6 +75,6 @@ extraEnv: | - name: KC_BOOTSTRAP_ADMIN_USERNAME value: admin - name: KC_BOOTSTRAP_ADMIN_PASSWORD - value: Paasadm1234! + value: ChangeMe1234! # 예시 값 — 배포 전 교체한다 - name: TZ value: Asia/Seoul diff --git a/manifests/helm/nemo/25.4.0/custom-values.yaml b/manifests/helm/nemo/25.4.0/custom-values.yaml index d6357d9..cfb9bde 100644 --- a/manifests/helm/nemo/25.4.0/custom-values.yaml +++ b/manifests/helm/nemo/25.4.0/custom-values.yaml @@ -1,10 +1,12 @@ -ngcAPIKey: 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 +# NGC API 키는 예시 값이다 — 배포 전 반드시 실제 키로 교체한다. +# 실제 키를 이 파일에 적어 커밋하지 않는다(nvcr.io pull 권한을 가진 자격증명이다). +ngcAPIKey: nvapi-EXAMPLE-REPLACE-WITH-YOUR-NGC-API-KEY imagePullSecrets: - name: nvcrimagepullsecret registry: nvcr.io username: $oauthtoken - password: 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 + password: nvapi-EXAMPLE-REPLACE-WITH-YOUR-NGC-API-KEY data-store: enabled: true