# Kubernetes and Node-RED credentials security

**URL:** <https://discourse.nodered.org/t/kubernetes-and-node-red-credentials-security/14295>\
**Category:** General\
**Created:** [13 August 2019 22:13 UTC](https://discourse.nodered.org/t/kubernetes-and-node-red-credentials-security/14295 "2019-08-13T22:13:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kolban](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/kolban/32/10366_2.png) [@kolban](https://discourse.nodered.org/u/kolban)\
**Post date:** [13 August 2019 22:13 UTC](https://discourse.nodered.org/t/kubernetes-and-node-red-credentials-security/14295/1 "2019-08-13T22:13:06Z")

</div>

I'm imagining running a Kubernetes cluster containing pods where the pods are running Node-RED. My sniff tests show this to work just fine. What is puzzling me is this story and its relationship with credentials security.

Imagine my Node-RED flow is calling outbound to some external services that need authentication. I am imagining creating some Node-RED credentials that contain a userid/password pair that are then used by Node-RED during run-time execution. For this to work, I think I need to edit my settings.js such that there is a value for credentialsSecret which can decode the credentials JSON file. And it is here I am getting nervous.

It seems that if I have a container that contains both my credentialsSecret and my credentials.json then we have a path to someone obtaining my 3rd party super secret userid/password (which I wish to prevent).

If I don't have a value for credentialsSecret in my settings.json, then the credentials are worthless and my solution won't run as Node-RED won't have the info it needs to perform a remote connection at run-time.

Are there any recipes or thinking on creating containers for execution under Kubernetes where credentials required to access remote 3rd party APIs?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [13 August 2019 22:20 UTC](https://discourse.nodered.org/t/kubernetes-and-node-red-credentials-security/14295/2 "2019-08-13T22:20:49Z")

</div>

This isn't specific to Node-RED - any application deployed in k8s that requires credentials needs to be able to access them securely.

The k8s docs cover this is great detail - [https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/)

That covers how to get the credentials available either as files on the pod's local filesystem, or via environment variables. Pick whichever approach you want (env var is probably a bit easier), and then edit your settings file to pickup the the value of `credentialSecret` from the corresponding place.

---

<div class="post-metadata">

**Author:** ![kolban](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/kolban/32/10366_2.png) [@kolban](https://discourse.nodered.org/u/kolban)\
**Post date:** [13 August 2019 22:30 UTC](https://discourse.nodered.org/t/kubernetes-and-node-red-credentials-security/14295/3 "2019-08-13T22:30:23Z")

</div>

Thank you sir. Super excellent response speed to the community (as always). Your link makes sense and am now going to study it in depth. However, I have what I think is a Node-RED oriented query:

If I understand correctly, the key that Node-RED uses to encrypt/decrypt the credentials is contained in the `settings.js` file under the key `credentialsSecret`. If I do not wish to supply this in a hard-coded form in pre-supplied `settings.js` file, is there an alternate way of telling Node-RED (at run-time) my `credentialsSecret`? For example, is there a run-time flag used when starting Node-RED or an existing environment variable that Node-RED looks at? Failing this, my resort is to create a "wrapper" that performs some form of text substitution in the `settings.js` before starting Node-RED itself.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [13 August 2019 22:37 UTC](https://discourse.nodered.org/t/kubernetes-and-node-red-credentials-security/14295/4 "2019-08-13T22:37:29Z")

</div>

The key thing to remember is that `settings.js` is a JavaScript file - not a static JSON file. So you can have code in settings.js that does whatever work it needs to generate the settings.

The most simple thing to do would be:

```auto
   credentialSecret: process.env.MY_CREDENTIAL_SECRET

```

And that will use the environment variable `MY_CREDENTIAL_SECRET`.

---

<div class="post-metadata">

**Author:** ![kolban](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/kolban/32/10366_2.png) [@kolban](https://discourse.nodered.org/u/kolban)\
**Post date:** [14 August 2019 00:23 UTC](https://discourse.nodered.org/t/kubernetes-and-node-red-credentials-security/14295/5 "2019-08-14T00:23:15Z")

</div>

Oh dear goodness I are dumb!!! And miss the wood for the trees. Thank you again kind sir!!!