PREFECT_API_AUTH_STRING should be a Secret Env var, not a clear text Env var in spawned Runs

[raayu83]

Currently in the spawned run pods, PREFECT_API_AUTH_STRING is created as a clear text Environment Variable, visible to anyone with access to the Kubernetes CLI or UI.
For security reasons, this should be based on a Secret, just as with Worker pods and the Server pod.

[raayu83]

Btw, thanks for implementing Basic Auth in the Helm charts! This helps a lot!

[mitchnielsen]

Hi @raayu83, thanks for reaching out.

In the Deployment manifest template, the auth string can be taken from a Secret if you provide worker.basicAuth.existingSecret. There are some more details available in https://github.com/PrefectHQ/prefect-helm/tree/main/charts/prefect-worker#basic-auth.

Is this what you were looking for?