openshift/scrub-secrets¶

Control whether tasks scrub secrets from disk at exit, or leave them at rest for debugging

This parameter controls the idle-scrub and PRE_SCRUB exit traps that every OpenShift task and the cluster prelude use to remove secret files (kubeconfig, SSH private keys, the hub kubeconfig) from the container's tmpfs when a task ends.

Usage¶

YAML

true    # Default. Scrub behavior is unchanged: every guarded trap arms
        # normally and secrets are removed at task exit, success or
        # failure.
false   # Debugging only. Every guarded scrub/trap site is skipped, so
        # secrets remain on the tmpfs until the container stops. Every
        # task that skips scrubbing logs a warning to the job log.

Set this to false ONLY while actively debugging a secrets-handling issue. Remember to remove this parameter (or set it back to true) when done debugging, so the idle-scrub guarantee resumes on the next run.

Objects that Reference openshift/scrub-secrets¶

tasks openshift-hub-cluster-init in Openshift as part of Templates.[1].Contents (used)
tasks openshift-spoke-cluster-join-hub in Openshift as part of Templates.[6].Contents (used)
tasks openshift-cluster-tools in Openshift as part of Templates.[2].Contents (used)
templates openshift-cluster-prelude.sh.tmpl in Openshift as part of Contents (used)
templates openshift-cluster-wait-for-install-complete.sh.tmpl in Openshift as part of Contents (used)
templates openshift-refresh-kubeconfig.sh.tmpl in Openshift as part of Contents (used)
templates openshift-cluster-wait-for-bootstrap-complete.sh.tmpl in Openshift as part of Contents (used)

Objects used by openshift/scrub-secrets¶

Not used in current content packs