TACC's deployment secrets exist only in a login-node home directory #124

Question

Where must TACC's deployment secrets live, and who can restore them if the login node is lost?

What is true today

TACC deploys with helm upgrade mint . -f values.yaml -f secrets.yaml from
~/tacc-values/shared on login-shared.tacc.utexas.edu.

values.yaml is the dynamo repo. secrets.yaml is not. It is untracked, and it is in one
home directory. It holds the CKAN API token, and it is the only copy.

The Results step depends on that token (#110). Lose the file and the token, and nobody can
answer what the deployment held.

Why it is a question, not a task

The answer is a custody decision. The options trade secrecy against recoverability:

• Commit it to dynamo. The repo is private. It already holds a Tapis password in cleartext
  (shared/values.yaml:128) and a Google Maps key. It is honest about where the deploy reads from.
• A Kubernetes Secret, with the chart reading existingSecret. The cluster becomes the source
  of truth. A new deploy needs the secret created first.
• A password manager, with the file rebuilt by hand at deploy time. Safest, and the easiest to
  forget.
• Sealed Secrets or an external secret store. Correct, and the most work.

Also settle a second thing: shared/values.yaml:128 carries a Tapis password in cleartext. It
is in git history already, so hiding it now is not enough. Decide whether to rotate it.

Scope

Does not block #77. It is a risk to name before the client depends on this deployment.