hashicorp / hashicorp/vault-secrets-operator

Vault Operator resyncing secret when VaultStaticSecret hmacSecretData field has been set to false

Open
#748 2 comments 0 reactions 0 assignees View on GitHub
enhancement sync-once
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Describe the bug**

Vault operator is performing drift detection and resyncing the secret when setting hmacSecretData = false

**To Reproduce**
Steps to reproduce the behavior:
1. Create a VaultStaticSecret resource with hmacSecretData set to false
2. Once the secret is synced, update the hmacSecretData and reset back to false
3. Delete leading vault operator

Application deployment:

```yaml
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: test
namespace: test
spec:
destination:
create: true
name: test
overwrite: false
hmacSecretData: false
mount: test
path: test
refreshAfter: 0s
type: kv-v2
vaultAuthRef: test
```

**Expected behavior**
When hmacSecretData is set to false, vault operator does not resync the secret in any event.

**Environment**
* Kubernetes version: 1.26
* vault-secrets-operator version: 0.6.0

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the VaultStaticSecret scenario from the issue, focusing on drift detection when hmacSecretData is toggled back to false. Trace the VaultStaticSecret reconciliation and resync behavior, then verify that setting hmacSecretData to false prevents resyncs after updates or operator restarts.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.