opened
et1975
username_0
Serving reactor files via mounted GitFS root exposes the backend logic to minions.
It seems though that reactors being exposed via the roots is not a _requirement_ for them to function and therefore IMHO is an oversight and a security risk. 
While there are workarounds and ways to hide sensitive information, it is not enough IMHO. Knowing what backend is doing can be of value by itself to an attacker.
Would be great to see GitFS configuration for reactors getting the same treatment as the one for pillars - separate, bypassing the root mounts, and being able to include the reactor.conf itself.
GitFS for Reactors
issue
created
basepi
username_1
You make great points here, and I think this is a great idea. Thanks for the request.
comment
created
mew1033
username_2
This is definitely something I want. Reactors should be store-able in gitfs without exposing them to minions.
comment
created
Da-Juan
username_3
I'm interested in this too!
comment
created
spyd3r
username_4
I'm interested in this feature as well.
comment
created
c4t3l
username_5
+1 internets for this idea!
comment
created
thatch45
username_6
I have added the nitrogen tag here, we would also want to be able to do this with thorium files as well.
comment
created
gtmanfred
username_7
You can put your reactor files in your regular gitfs fileserver, and just reference it using `salt://reactor/whatever.sls`
comment
created
et1975
username_0
I'm confused, in the context of the problem ("hide reactor logic from the minions") what would that accomplish?
comment
created
gtmanfred
username_7
ahh, i missed that part of the feature request, nevermind.
comment
created
et1975
username_0
this issue is closed prematurely.
comment