Summary
The IBAC judge bearer token (defaults.ibac.judgeBearer, plumbed via the new platform IBACConfig) is rendered inline into the per-agent authbridge-config-<name> ConfigMap as part of the ibac plugin config. A ConfigMap is plaintext-at-rest and readable by anyone with namespace get configmap — a much more broadly-granted RBAC verb than get secret. It also flows into etcd (unencrypted by default), GitOps diffs, cluster backups, and kubectl -o yaml output/logs.
Introduced in #524 (AuthBridge layer-3 preset rendering).
Why this matters
The rest of that ConfigMap (jwt-validation issuer, keycloak URLs, token-exchange identity, outbound routes) is legitimately non-secret configuration — the bearer is the lone credential in an otherwise-appropriate config blob. Today the field is frequently empty (judge auth isn't always required), so the exposure is currently latent — but that's a trap: a plaintext path invites someone to populate a real token later without realizing where it lands.
Proposed fix
Source the judge bearer from a Secret via secretKeyRef rather than inlining it into the ConfigMap. Note this is not an operator-only change: the AuthBridge sidecar reads its config inline from the mounted config.yaml, so it must be taught to source that one field from a mounted Secret / env var (e.g. env interpolation in config, or a projected Secret merged at mount). That coordinated operator + authbridge-plugin change is why this was scoped as a follow-up rather than folded into #524.
Priority
Should land before the bearer is populated with a real token in any live deployment.
Raised as a non-blocking review suggestion by @cwiklik on #524.
Summary
The IBAC judge bearer token (
defaults.ibac.judgeBearer, plumbed via the new platformIBACConfig) is rendered inline into the per-agentauthbridge-config-<name>ConfigMap as part of theibacplugin config. A ConfigMap is plaintext-at-rest and readable by anyone with namespaceget configmap— a much more broadly-granted RBAC verb thanget secret. It also flows into etcd (unencrypted by default), GitOps diffs, cluster backups, andkubectl -o yamloutput/logs.Introduced in #524 (AuthBridge layer-3 preset rendering).
Why this matters
The rest of that ConfigMap (jwt-validation issuer, keycloak URLs, token-exchange identity, outbound routes) is legitimately non-secret configuration — the bearer is the lone credential in an otherwise-appropriate config blob. Today the field is frequently empty (judge auth isn't always required), so the exposure is currently latent — but that's a trap: a plaintext path invites someone to populate a real token later without realizing where it lands.
Proposed fix
Source the judge bearer from a Secret via
secretKeyRefrather than inlining it into the ConfigMap. Note this is not an operator-only change: the AuthBridge sidecar reads its config inline from the mountedconfig.yaml, so it must be taught to source that one field from a mounted Secret / env var (e.g. env interpolation in config, or a projected Secret merged at mount). That coordinated operator + authbridge-plugin change is why this was scoped as a follow-up rather than folded into #524.Priority
Should land before the bearer is populated with a real token in any live deployment.
Raised as a non-blocking review suggestion by @cwiklik on #524.