- Shipped
- September 17, 2026 at 4:28 AM UTC
- Author
- Kamo
- Commit
- ff03c52
The Janus API, token and admin secrets and the TURN password were committed four times over: as @Value defaults in WebRTCController and JanusService, as defaults in the bundled and the k8s application.yml, and as literal env values in k8s/deployment.yaml. GET /api/webrtc/config also returned the Janus API secret in its response. Six more classes defaulted **************** to a known string, and the bundled application.yml defaulted the datasource password, so a missing environment variable would have meant a guessable credential instead of a failed start. Checked before removing: no Janus server answers (https://kamocrm.com:8089 times out while :443 on the same host answers; there is no Janus pod, service or ingress), and nothing in kamo-internal, the mobile app, kamo-js or kamo-meet calls /api/webrtc. coturn authenticates with use-auth-secret from its own Secret (TURN_SECRET), so the static TURN password was accepted by nothing. **************** and DB_PASSWORD are set from Secrets, and the deployment's SPRING_CONFIG_LOCATION means the bundled application.yml is never loaded in the pod. - Janus secrets and the TURN password now default to empty; token signing refuses an unconfigured secret instead of signing with an empty key, and the config response offers a TURN server only when it has credentials. - The internal-auth secret and datasource password have no default at all (${X}). - The three literal JANUS_* env entries leave deployment.yaml (kubectl apply's three-way merge removes them). - /api/webrtc/config no longer includes apiSecret. NoLiteralSecretDefaultsTest scans src/main/java, src/main/resources and k8s: a placeholder named secret, password, token, api-key or private-key may not carry a literal default, and deployment.yaml may not give such an env var an inline value. The in-pod keystore password is the one listed exception. With either rule broken it fails, and it checks that it is really reading those files. The values removed here are still in git history, so rotate them if they are used anywhere outside this service.