hashicorp / hashicorp/vault-secrets-operator
Allow kv secret metadata to appear in k8s secret labels
- Dominant language
- Go
- Stars
- 600
- Forks
- 146
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Is your feature request related to a problem? Please describe.**
When keeping track of secret revisions or traversing through a incident that may be caused by a accidental secret revision bump attaching the vault secret metadata as a k8s label could be beneficial to check and ensure all the secrets are in the same version.
the metadata that keep tracks of the revision can be a dynamic hash we generate or a default timestamp we generate ourselves, but i think it would be beneficial when troubleshooting revision issues during incidents for secrets.
**Describe the solution you'd like**
pass the kv metadata value to k8s secrets labels
```
Labels: app.kubernetes.io/component=secret-sync
app.kubernetes.io/managed-by=hashicorp-vso
app.kubernetes.io/name=vault-secrets-operator
secrets.hashicorp.com/vso-ownerRefUID=8fa452c0-c64e-4035-8c88-d500dbef58c2
secrets.hashicorp.com/secret-metadata=revisionHash:HASH
```
**Describe alternatives you've considered**
we can keep track using the versions that are deployed in the StaticSecretSpec, but to my knowledge there is no value in version=Latest version.
we either have to remove version as a value or manually edit the version one below the latest version.
we can also keep track using the AGE value in kubectl get secrets itself, but that is not a reliable metric. since secrets can be deleted and re-applied for different reasons.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading the StaticSecretSpec handling and the reconciliation path that creates Kubernetes Secrets; the issue does not name specific files or tests. Trace where existing Secret labels are assembled, then verify that the requested KV metadata appears as a label and that the relevant reconciliation behavior is covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100