hashicorp / hashicorp/vault-secrets-operator
Add support for Vault Password Policies in VaultStaticSecret
- Dominant language
- Go
- Stars
- 600
- Forks
- 146
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Is your feature request related to a problem? Please describe.**
Hello, I use auto-generated passwords for some apps on Kubernetes, mostly for internal API tokens and session passwords.
However, these passwords are not synchronized to or from Vault (i use [mittwald/kubernetes-secret-generator](https://github.com/mittwald/kubernetes-secret-generator)).
I have two problems with theses password not synchronized to Vault:
- If I redeploy a cluster from scratch (e.g., after a disaster), my passwords and API tokens change.
- When I deploy two identical clusters on different sites, they do not have the same password/API token on both sides.
**Describe the solution you'd like**
I would like to have a **passwordPolicy** field on **VaultStaticSecret** that auto-generates a password and stores it back to Vault if the specified path is empty and the password policy exist. eg:
~~~
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: mysecret
spec:
mount: kv2
type: kv-v2
path: mysecret
passwordPolicy: mypolicy
refreshAfter: 60s
destination:
create: true
name: mysecret
~~~
If the path `kv2/mysecret` is empty and the password policy **mypolicy** exist, a password is generated from `/sys/policies/password/mypolicy/generate` and stored to `kv2/mysecret`.
**Describe alternatives you've considered**
I have considered to generate theses password from Terrafom (or other tools) and not directly from Kubernetes but that's broke my GitOps workflow and leak password to Terraform state.
Thank's,
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.