hashicorp / hashicorp/vault-secrets-operator

VaultStaticSecret status field

Open
#1,073 1 comment 10 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Is your feature request related to a problem? Please describe.**
VaultStaticSecret has no status field during processing. If there is an error it's not represented in Status (available only in k8s events) and status is unknown. If secret was successfully processed status filed will be propagated with hmac and generation fields, but without 'status state' itself.

**Describe the solution you'd like**
Would be great to have a state represented in status, like:
- Created
- Processing
- Error
- Success

Also it will be helpful to set a custom healthcheck in ArgoCD as well as `kubectl get vaultstaticsecret` showing the state of a resource

**Describe alternatives you've considered**
For ArgoCD healhcheck I use this code:
```lua
resource.customizations.health.secrets.hashicorp.com_VaultStaticSecret: |
hs = {}

-- Check if the VSO operator has successfully processed this resource
if obj.status ~= nil and obj.status.lastGeneration ~= nil then
-- VSO has processed the resource and created a secret
if obj.metadata.generation == obj.status.lastGeneration then
-- Generation matches - resource is up to date and healthy
hs.status = "Healthy"
hs.message = "VaultStaticSecret synced successfully"
return hs
else
-- Generation mismatch - resource is being updated
hs.status = "Progressing"
hs.message = "VaultStaticSecret update in progress"
return hs
end
end

-- Check if VSO has started processing (finalizer present)
if obj.metadata.finalizers ~= nil then
for i, finalizer in ipairs(obj.metadata.finalizers) do
if finalizer == "vaultstaticsecret.secrets.hashicorp.com/finalizer" then
-- VSO is processing but no status yet - still working
hs.status = "Progressing"
hs.message = "VaultStaticSecret being processed by VSO"
return hs
end
end
end

-- No status and no VSO finalizer - VSO couldn't process the resource
-- This indicates a configuration error (bad path, auth issues, etc.)
hs.status = "Degraded"
hs.message = "VaultStaticSecret not processed - check configuration, auth, or Vault path"
return hs
```
But in HEALTH DETAILS will be a static message without any useful info what is exactly wrong

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing how VaultStaticSecret status is currently populated and how processing errors are exposed through Kubernetes events. Compare the requested Created, Processing, Error, and Success states with the existing lastGeneration and hmac fields, then consider the ArgoCD healthcheck and kubectl output as acceptance points. Done means resource state and useful error information are represented in status.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.