hashicorp / hashicorp/vault-secrets-operator

VaultStaticSecret and Database Engine

Open
#1,072 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Is your feature request related to a problem? Please describe.**
According to the documentation, the Vault Secrets Operator `VaultStaticSecret` only supports `kv-v1` and `kv-v2` engines.

It would be useful for it to also support static secrets coming from the `database` engine, like db credentials from a static db role.

**Describe alternatives you've considered**
I've tried the `VaultDynamicSecret` with the path from a static role in the database engine, and that seems to work as the k8s secret gets created, but it still seems to treat the credentials as a lease, which is not the case with a static role. Is that expected usage of the `VaultDynamicSecret`? When I set `rolloutRestartTargets` the restart seems to be triggering constantly even if the secret is not

**Describe the solution you'd like**
Is there other way of syncing a Static DB Secret to K8s with VSO or is this functionality currently missing?

Ideally `VaultStaticSecret` should work with the database engine to support static roles. In case it already does support it documentation should be updated.

**Additional context**
n/a

Contributor guide

No contributing guide indexed for this repository

Research direction

No source files or tests are named. Start by locating the VaultStaticSecret and VaultDynamicSecret handling and the related database-engine documentation; confirm whether static database roles are supported without lease behavior or repeated restart triggers, then document or test the expected behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
databases, infrastructure, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.