Kubernates -Tomcat context.xml having DB password as a plain text (inside the container)

[raj-kotha]

Describe the bug

Tomcat context.xml having DB password as a plain text

To Reproduce NA

Expected behavior

Encrypted DB password

Chart version

Server (if applicable, please complete the following information):

• OS: [e.g. Ubuntu 18.04]
• Environment: [e.g. Amazon EKS, Open Source Kubernetes 1.11, etc.]
• Database: [e.g. PostgreSQL]

Additional context

[rbogendoerfer]

This is not a bug, this is a well-known Tomcat limitation. Tomcat does not offer a way to encrypt passwords. See https://cwiki.apache.org/confluence/display/TOMCAT/Password for details.

In the same way you should secure your context.xml against unauthorized (read) access in a bare metal or VM environment, you should also secure your Kubernetes cluster against access of the context.xml file inside the container.

[pega-sagas1]

https://github.com/pegasystems/pega-helm-charts/blob/master/charts/pega/config/deploy/context.xml.tmpl this context.xml.tmpl will get resolved to context.xml when we do helm deploy. when it resolves, the password and other values are securely sent inside the pod. Once inside the tomcat folder, tomcat reads the file as it is only with plain text. thats tomcat feature that it can read only as plain text.