Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update index.md #197

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Update index.md #197

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6f2b27a
Update index.md
samweaver Apr 28, 2023
8cd16ab
Update index.md
samweaver May 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 19 additions & 8 deletions pages/operations/security/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,29 +3,40 @@ title: Security Concepts
description: Learn about what Plural has access to at various steps of deployment.
---

## Cloud Access
## What access does Plural have to my Cloud account?

### Plural CLI
There are 2 methods to deploy via Plural. The access that we have to your cloud account is discussed per each method below.

Plural **does not** have access to any cloud environments when deployed through the CLI. We generate deployment manifests in the Plural Git repository and then use your configured cloud provider's CLI on your behalf. We cannot perform anything outside of deploying and managing the manifests that are created in your Plural Git repository.
### When using the Plural CLI

### Plural Cloud Shell
Plural **does not** have access to any cloud environments when deployed through the CLI. We generate deployment manifests in the Plural Git repository and then use your locally configured cloud provider's CLI on your behalf. We cannot perform anything outside of deploying and managing the manifests that are created in your Plural Git repository.

Plural **does** have access to your cloud credentials when deployed through the Cloud Shell. In order to streamline the Cloud Shell experience, we securely store cloud credentials to create resources on your behalf. You can eject from the Cloud Shell to the CLI at any time to save your configuration and revoke our access. This is done with the following steps:
### When using the Plural Cloud Shell

Plural **does** have access to your cloud credentials when deployed through the Cloud Shell. In order to streamline the Cloud Shell experience, we securely store ecrypted cloud credentials to create resources on your behalf. You can eject from the Cloud Shell to the CLI at any time to save your configuration and revoke our access. This is done with the following steps:

1. [Install the Plural CLI](/getting-started/quickstart).
2. Run `plural shell sync` on your local machine.
3. Run `plural shell purge` in the Cloud Shell to destroy it.

## Plural Console
## What permissions does the Plural Console have?

Our console has elevated permissions when running in your Plural Kubernetes cluster, but it runs in its own environment to alleviate security concerns. Its permissions are required in order to listen for new versions of packages to apply automated updates to your applications.

## GitHub
## What permissions does Plural have to GitHub?

Plural **does not** have access to repositories that have not been created by Plural.
Plural will only use the Github access token while creating the repo then, then throws away the token once created.

When using the CLI or Cloud Shell, Plural will receive the following permissions:

- Create GitHub repositories on your behalf
- Commit changes to repositories that Plural has created
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should make it clear that we only get use the access token while creating the repo then throw them away as well


Plural **does not** have access to repositories that have not been created by Plural. 
## Do I HAVE to oAuth into Github?

No, if you don't want to oAuth, you can create a repo and then run `plural init` inside it to initialize it for Plural.

## Where is application configuration stored, including credentials?

Configuration is stored in your Git repo. Credentials are stored encrypted in configuration.