Here's our scenario. I have a NodeJS server running that connects to a Microsoft SQL Server using an application account (SQL Basic Auth). The Username and Password were stored in the configuration files when the app was created.

We now want to tighten down security. Originally, an idea was floated of using Environment Variables and having the secure values injected into Kubernetes instances. The problem is, that requires someone to know the password to add it to K8s. Also, the passwords need to be changable at a moments notice, but the server has to be 24/7/365 available.

Somehow, I need to be able change the passwords and simultaneously let clients be able to use the new passwords.

  • The title of your post doesn’t really match with what you’re actually asking.
    – Teun Vink
    Sep 23 '21 at 5:50
  • If you want the application to run in unattented mode and be able to automatically restart if the server reboots, then the database account and password has to be available in a non encrypted form. The alternative is that staff members are present 24/24 and that each of them has a key to decrypt the database password. It can make sense for highly sensitive data but it does have a cost. Sep 23 '21 at 7:16
  • What's your threat model? What attack are you trying to prevent here?
    – Polynomial
    Sep 23 '21 at 12:33
  • The threat is that production passwords are currently available to all user that access the code base. We don't want users to be able to access passwords for production at any time. Sys Admins would be able to read/set so secrets would work, but the 24/7 servers need to use the passwords real time so they don't reboot to load the change. Sep 23 '21 at 13:33
  • "production passwords are currently available to all user that access the code base" - why do users have access to the code base, and why aren't the prod passwords in config files that aren't checked into the source repo?
    – Polynomial
    Sep 23 '21 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.