hashicorp / hashicorp/vault-secrets-operator

refresh time for dynamic ldap static-role secret

Open
#445 3 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Is your feature request related to a problem? Please describe.**
hi, when creating a dynamic LDAP secret of type static-role (semi automatic), LDAP user exists and vault only periodically rotate it's password. the vault operator secret type is VaultDynamicSecret therefore there isn't any option to add the refreshAfter: 60s parameter.
in this case how can i make sure the vault operator will sync the newly rotated LDAP password to k8s ? is that working automatically by a trigger from vault or has some kind of manual interval that can be configured ?

**Describe the solution you'd like**
eighter automatically trigger update once vault rotated the password or some kind of manual interval that can be configured.

**Describe alternatives you've considered**
none

**Additional context**
configuring the LDAP static role secret:
```
vault write ldap/static-role/hashicorp \
dn='uid=hashicorp,ou=People,dc=ninjadude,dc=com' \
username='hashicorp' \
rotation_period="60m"
```
configuring the VaultDynamicSecret:
```
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
namespace: default
name: example-dyn
spec:
vaultAuthRef: example
mount: ldap
path: static-cred/hashicorp
allowStaticCreds: true
destination:
create: true
name: dynamic1
rolloutRestartTargets:
- kind: "Deployment"
name: "deployment-smb"
```

thanks
Dave

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.