Hey! I’m having trouble trying to setup Airbyte to use a CloudSQL as an external database, and am wondering about your thoughts about the security aspect of using the default database directly in Kubernetes. If the credentials for destinations and connections is saved to this database it would be by far the most sensitive database in my organization and should also ideally be the most secure. My fear is that a sneaky pod from a different namespace could fetch the secrets and env vars for the DB connection, connect to and get credentials stored in the database and worst case use those to fetch our data from third-parties where we can’t enforce much restrictions on API key usage and such. A tight network policy for the namespace might be in order. What measures are taken in the Airbyte OSS installation to make sure that only airbyte can access the database? What other best practices should I do if I decide to go for the default DB in Kubernetes?

A message from kapa.ai

@kapa.ai Can you find any examples or guides to use CloudSQL proxy with Airbyte OSS?

A message from kapa.ai

@kapa.ai Is the SECRET_PERSISTENCE variable available in the Airbyte Helm deployment? I cannot find any reference to it in the helm values source code

A message from kapa.ai