hashicorp / hashicorp/vault-secrets-operator

Allow kv secret metadata to appear in k8s secret labels

Open
#378 0 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Is your feature request related to a problem? Please describe.**

When keeping track of secret revisions or traversing through a incident that may be caused by a accidental secret revision bump attaching the vault secret metadata as a k8s label could be beneficial to check and ensure all the secrets are in the same version.
the metadata that keep tracks of the revision can be a dynamic hash we generate or a default timestamp we generate ourselves, but i think it would be beneficial when troubleshooting revision issues during incidents for secrets.

**Describe the solution you'd like**
pass the kv metadata value to k8s secrets labels
```
Labels: app.kubernetes.io/component=secret-sync
app.kubernetes.io/managed-by=hashicorp-vso
app.kubernetes.io/name=vault-secrets-operator
secrets.hashicorp.com/vso-ownerRefUID=8fa452c0-c64e-4035-8c88-d500dbef58c2
secrets.hashicorp.com/secret-metadata=revisionHash:HASH

```
**Describe alternatives you've considered**

we can keep track using the versions that are deployed in the StaticSecretSpec, but to my knowledge there is no value in version=Latest version.
we either have to remove version as a value or manually edit the version one below the latest version.
we can also keep track using the AGE value in kubectl get secrets itself, but that is not a reliable metric. since secrets can be deleted and re-applied for different reasons.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the StaticSecretSpec handling and the reconciliation path that creates Kubernetes Secrets; the issue does not name specific files or tests. Trace where existing Secret labels are assembled, then verify that the requested KV metadata appears as a label and that the relevant reconciliation behavior is covered by tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.