hashicorp / hashicorp/vault-secrets-operator

vault static secret version replacing behavior issue

Open
#450 8 comments 0 reactions 1 assignee Claimed by @benashz View on GitHub
enhancement
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

lets say i would like the vso to push vault secrets latest 3 version to the cluster.

we currently have a version parameter and we can bump `version:1 -> 2` and change the destination k8s secrets name that will be created. however it seems like we cannot use 3 vault static secret configs each referencing the same vault secret but with different versions and different destination names. note the purpose of this is just to keep the latest 3 versions of the same secret available for the pod to injest, thus i am open to any workarounds.



**Expected behavior**
if the vault secret is
```
version1
secret
key: v1secretvalue
version2
secret
key: v2secretvalue
version3
secret
key: v3secretvalue
```
we then create 3 different vss configs
```
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: secret
namespace: default
spec:
destination:
create: true
name: secretv1
hmacSecretData: true
version: 1
mount: secret
path: test
refreshAfter: 5s
type: kv-v2
```
```
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: secret
namespace: default
spec:
destination:
create: true
name: secretv2
hmacSecretData: true
version: 2
mount: secret
path: test
refreshAfter: 5s
type: kv-v2
```
3rd is the same as the example above just with higher version and

the current behavior is: vso will just replace the existing secret instead of create a new destination secret based on the new version.

the expected behavior is: creating three secrets that is sourced from the same vault secret but because the version and destination name is different, it will create three secrets.



Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.