hashicorp / hashicorp/vault-secrets-operator
VaultStaticSecret and Database Engine
- Dominant language
- Go
- Stars
- 600
- Forks
- 146
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Is your feature request related to a problem? Please describe.**
According to the documentation, the Vault Secrets Operator `VaultStaticSecret` only supports `kv-v1` and `kv-v2` engines.
It would be useful for it to also support static secrets coming from the `database` engine, like db credentials from a static db role.
**Describe alternatives you've considered**
I've tried the `VaultDynamicSecret` with the path from a static role in the database engine, and that seems to work as the k8s secret gets created, but it still seems to treat the credentials as a lease, which is not the case with a static role. Is that expected usage of the `VaultDynamicSecret`? When I set `rolloutRestartTargets` the restart seems to be triggering constantly even if the secret is not
**Describe the solution you'd like**
Is there other way of syncing a Static DB Secret to K8s with VSO or is this functionality currently missing?
Ideally `VaultStaticSecret` should work with the database engine to support static roles. In case it already does support it documentation should be updated.
**Additional context**
n/a
Contributor guide
No contributing guide indexed for this repository
Research direction
No source files or tests are named. Start by locating the VaultStaticSecret and VaultDynamicSecret handling and the related database-engine documentation; confirm whether static database roles are supported without lease behavior or repeated restart triggers, then document or test the expected behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- databases, infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100