False security issues in gitops-template

[fharper]

Which version of kubefirst are you using?

ALL

Which cloud provider?

None specific

Which DNS?

None specific

Which installation type?

None specific

Which distributed Git provider?

None specific

Did you use a fork of gitops-template?

No

Which Operating System?

None specific

What is the issue?

GitGuardian, and probably other security scanning tools are reporting security issues with the gitops-template repository. Those are secrets we leak in some previous commit. Security-wise, they are not a concern as we either revoke the SSH key, or the username/password are not creating security risks.

Still, we should remove the offending commits, and rebase to ensure they are not part of the Git history to prevent these type of tools to report those as security risks, since they are not. It is important as many companies are doing security assessments before using a product like ours, and they may not take the time to validate those with us, and dispatch our solution right away.

The task at hands are:

• Remove SSH key from fharper/gitops-template@2cf8915#diff-30284f4d75e30c5a033eb156ef0502f6458db5da33835741efaa6c8975a0a92dR1
• Delete this commit fharper/gitops-template@07a186a#diff-30284f4d75e30c5a033eb156ef0502f6458db5da33835741efaa6c8975a0a92dL1
• Modify the following commits with --username ${BASIC_AUTH_USER} --password ${BASIC_AUTH_PASS} instead of --username k-ray --password feedkraystars
  • fharper/gitops-template@acb4fa6#diff-6bfbd3bd5c00ae381359a364ddb5181fad9536515152f3a0f30e41c629ca0224L69
  • fharper/gitops-template@acb4fa6#diff-01ec4a4845ff60528b5fdf5251fbd4323770601dfcff9333f53d8ae10df381e1L69
  • fharper/gitops-template@acb4fa6#diff-1fda388e2fa6d177c017fa768c05626b2d288c1ba9cc1b3b366e343f71139ed9L69
  • fharper/gitops-template@acb4fa6#diff-557fe95c628a6792a4718aa062661aac5bbc60e3740e8f291e285b0c838ca137L69
  • fharper/gitops-template@5c91fa2#diff-1c97ddab0986beafc2addc32f65608fea0d70bf751104e7df93d20ba41e6974fL69

Code of Conduct

• I agree to follow this project's Code of Conduct