- Shipped
- August 11, 2026 at 2:18 AM UTC
- Author
- Kamo
- Commit
- ff6ee89
The mail MySQL password sat in plaintext across fourteen files here — in ConfigMaps that kubectl will hand to anyone who can read them, in two Jobs that CI applies on every mail deploy, in a Secret manifest whose stringData defeated the point of being a Secret, and in a batch script where it was also the SSH login for the cluster nodes. Every live consumer now takes it from the existing mysql-secret through the environment and substitutes it at startup. Dovecot and Postfix both refuse to start when it is empty rather than running degraded — Postfix matters most there, because it treats an unusable MySQL map as "no match" and would bounce every inbound message as an unknown recipient instead of failing visibly. mail/mysql-secret.yaml is deleted rather than templated. CI applied it, so a placeholder version would have overwritten the working secret and left MySQL rejecting every connection. The workflow now requires the secret to exist and fails with the command to create it. Also deletes four dead manifests that carried the credential and are applied by nothing — dovecot-configmap.yaml and dovecot-deployment.yaml describe a different image than what runs; the live pair is the -simple one. This removes the credential from the repo. It does NOT remediate the exposure: the same string is live in 22 objects across six namespaces, including MinIO, superadmin auth and node SSH. See the report accompanying this change.