hashicorp / hashicorp/vault-secrets-operator
VaultStaticSecret status field
- Dominant language
- Go
- Stars
- 600
- Forks
- 146
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Is your feature request related to a problem? Please describe.**
VaultStaticSecret has no status field during processing. If there is an error it's not represented in Status (available only in k8s events) and status is unknown. If secret was successfully processed status filed will be propagated with hmac and generation fields, but without 'status state' itself.
**Describe the solution you'd like**
Would be great to have a state represented in status, like:
- Created
- Processing
- Error
- Success
Also it will be helpful to set a custom healthcheck in ArgoCD as well as `kubectl get vaultstaticsecret` showing the state of a resource
**Describe alternatives you've considered**
For ArgoCD healhcheck I use this code:
```lua
resource.customizations.health.secrets.hashicorp.com_VaultStaticSecret: |
hs = {}
-- Check if the VSO operator has successfully processed this resource
if obj.status ~= nil and obj.status.lastGeneration ~= nil then
-- VSO has processed the resource and created a secret
if obj.metadata.generation == obj.status.lastGeneration then
-- Generation matches - resource is up to date and healthy
hs.status = "Healthy"
hs.message = "VaultStaticSecret synced successfully"
return hs
else
-- Generation mismatch - resource is being updated
hs.status = "Progressing"
hs.message = "VaultStaticSecret update in progress"
return hs
end
end
-- Check if VSO has started processing (finalizer present)
if obj.metadata.finalizers ~= nil then
for i, finalizer in ipairs(obj.metadata.finalizers) do
if finalizer == "vaultstaticsecret.secrets.hashicorp.com/finalizer" then
-- VSO is processing but no status yet - still working
hs.status = "Progressing"
hs.message = "VaultStaticSecret being processed by VSO"
return hs
end
end
end
-- No status and no VSO finalizer - VSO couldn't process the resource
-- This indicates a configuration error (bad path, auth issues, etc.)
hs.status = "Degraded"
hs.message = "VaultStaticSecret not processed - check configuration, auth, or Vault path"
return hs
```
But in HEALTH DETAILS will be a static message without any useful info what is exactly wrong
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing how VaultStaticSecret status is currently populated and how processing errors are exposed through Kubernetes events. Compare the requested Created, Processing, Error, and Success states with the existing lastGeneration and hmac fields, then consider the ArgoCD healthcheck and kubectl output as acceptance points. Done means resource state and useful error information are represented in status.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100