ESS 3.1
Adds least-privilege database credential separation to the ESS 3.0 platform.
Last updated
Adds least-privilege database credential separation to the ESS 3.0 platform.
ESS 3.1 builds on ESS 3.0 by introducing least-privilege database credential separation for all PostgreSQL-backed services, reducing the blast radius of a compromised credential.
Database Credential Separation — ESS services now support separate DDL credentials (used by Flyway at startup for schema migrations) and DML credentials (used at runtime for application queries). DML credentials are restricted to read/write operations only and cannot modify the database schema. The credential split is opt-in; in the default configuration both credentials reference the same Kubernetes secret, so no changes are required to upgrade. See 3.x Changelogs for configuration details.
Last updated