hashicorp / hashicorp/vault-secrets-operator

Add support for Vault Password Policies in VaultStaticSecret

Open
#451 2 comments 3 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Is your feature request related to a problem? Please describe.**

Hello, I use auto-generated passwords for some apps on Kubernetes, mostly for internal API tokens and session passwords.
However, these passwords are not synchronized to or from Vault (i use [mittwald/kubernetes-secret-generator](https://github.com/mittwald/kubernetes-secret-generator)).

I have two problems with theses password not synchronized to Vault:
- If I redeploy a cluster from scratch (e.g., after a disaster), my passwords and API tokens change.
- When I deploy two identical clusters on different sites, they do not have the same password/API token on both sides.

**Describe the solution you'd like**

I would like to have a **passwordPolicy** field on **VaultStaticSecret** that auto-generates a password and stores it back to Vault if the specified path is empty and the password policy exist. eg:

~~~
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: mysecret
spec:
mount: kv2
type: kv-v2
path: mysecret
passwordPolicy: mypolicy
refreshAfter: 60s
destination:
create: true
name: mysecret
~~~

If the path `kv2/mysecret` is empty and the password policy **mypolicy** exist, a password is generated from `/sys/policies/password/mypolicy/generate` and stored to `kv2/mysecret`.

**Describe alternatives you've considered**

I have considered to generate theses password from Terrafom (or other tools) and not directly from Kubernetes but that's broke my GitOps workflow and leak password to Terraform state.

Thank's,

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.