-
Notifications
You must be signed in to change notification settings - Fork 1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(k8-operator): push secrets #2815
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Need to application test. But some questions from my side
- Was this library something we were using before
go-logr
because I feel like it's quite unused one and uber zap is the most prominent one in this space. - Nit: Some messages starts with sentence case while others in small case
k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_controller.go
Outdated
Show resolved
Hide resolved
56760a0
to
01dcbb0
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Issue: The secrets that are created by the operator keep being updated (so the number of secret versions keep going up). If there aren't any changes, we shouldn't make a update.
For future PRs, i recommend doing a separate PR to do folder restructure first and get it merged. This helps to reduce the surface area of pr testing and allows us to merge prs quicker.
Testing i did:
- auto secrets auto redeploy
- delete managed secret
- add new key and have it synced
Need to do more testing on secret push after the update bug is patched.
For docs:
- I think we now have too many things in one page. Let's break it up into another sub page of k8s integration page
k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_controller.go
Show resolved
Hide resolved
4a78d99
to
7eb05af
Compare
Description 📣
This PR introduces support for pushing secrets from the K8 operator into Infisical. We are using policies for the replacement of existing secrets. This mean the user can opt-in to overwrite existing/conflicting secrets in Infisical, to treat the K8 operator as the source of truth.
The operator will automatically update the serverside secret values if it detects a drift has happened, even if the key of a secret changes. If a secret key changes, the secret will be deleted and re-created with the correct secret key. We do this by keeping a map of ID/secret-key, that we are verifying on each reconcile.
If the deletionPolicy is set to Delete, all secrets managed by the operator will be deleted once the InfisicalPushSecret CRD is deleted.
Additionally, we are now using a proper logger for all our CRD's. No more printf or println statements.
Type ✨