decoding the config map

[yanivpaz]

Looking on the config map created by the external secret controller -
I see that the password is encoded, so it can be easily decoded :

 echo MTIzNA== |base64 -d

how it is possible to prevent users to decode the password?

[Flydiverny]

Please provide more context. There's no config map used by KES.

If this is in regards to the resulting secrets, then yes same limitations as with normal secrets apply. Use RBAC to control who can read your secrets.

Edit: didn't mean to close

[yanivpaz]

Thanks for the answer.
Yes, I referred to the resulting secret.
The KES is a very cool solution - but I am looking for the decryption at the pod level for better security.

[Flydiverny]

There's been some work on this in the past in #46 and #77 not sure if there's anything usable available.
Also related #81

[Flydiverny]

Closing this in favor of the referenced issues