hashicorp / hashicorp/vault-secrets-operator

Have the ability to pull all versions of a secret into a singular templated JSON k8s secret

Open
#1,276 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Is your feature request related to a problem? Please describe.**

It looks like we're able to pull specific versions out of vault, but not specify to pull all unknown versions into a speicifc k8s secret. I have a request to use ESO to sync secrets onto disk, but we need to combine all (un)known versions of specific secret into one.

My understanding is as follows, if we have the following secret that has 2 versions, we'd have to specify that.

```yaml
external_secrets:
- our_name: foo
store:
name: keys
kind: SecretStore
data:
- secretKey: bar_1
remoteRef:
key: bar
version: "1"
- secretKey: bar_2
remoteRef:
key: bar
version: "2"
```

We could then template that to combine the versions:

```
template:
data:
bar: |
{{ dict "currentVersion" "2" "versions" (list ...) | toPrettyJson }}
```

But, this would require us to know what versions currently exist, and we have a process that rotates secrets for us without us manually updating vault.

**Describe the solution you'd like**

Ideally, configuration to exist that would allow us to pull all versions for a specific secret out of vault, giving us the ability to template it

If this configuration is used, and template isn't specified, I'd expect something to error.

```yaml
external_secrets:
- our_name: foo
store:
name: keys
kind: SecretStore
data:
- secretKey: bar
remoteRef:
key: bar
version: "*"
template:
data:
bar: |
{{ dict "currentVersion" "$LATEST" "versions" (list ...) | toPrettyJson }}
```

**Describe alternatives you've considered**

At the moment, specifying versions manually in configuration (as above).

**Additional context**

N/A.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing how remoteRef.version and template.data are handled for Vault-backed ExternalSecret data, then identify the entry points responsible for fetching versions and rendering templates. Done means a configuration can request all versions, expose them to the template with the latest version, and reject the configuration when no template is provided.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.