hashicorp / hashicorp/vault-secrets-operator
Vault Operator resyncing secret when VaultStaticSecret hmacSecretData field has been set to false
- Dominant language
- Go
- Stars
- 600
- Forks
- 146
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Describe the bug**
Vault operator is performing drift detection and resyncing the secret when setting hmacSecretData = false
**To Reproduce**
Steps to reproduce the behavior:
1. Create a VaultStaticSecret resource with hmacSecretData set to false
2. Once the secret is synced, update the hmacSecretData and reset back to false
3. Delete leading vault operator
Application deployment:
```yaml
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: test
namespace: test
spec:
destination:
create: true
name: test
overwrite: false
hmacSecretData: false
mount: test
path: test
refreshAfter: 0s
type: kv-v2
vaultAuthRef: test
```
**Expected behavior**
When hmacSecretData is set to false, vault operator does not resync the secret in any event.
**Environment**
* Kubernetes version: 1.26
* vault-secrets-operator version: 0.6.0
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the VaultStaticSecret scenario from the issue, focusing on drift detection when hmacSecretData is toggled back to false. Trace the VaultStaticSecret reconciliation and resync behavior, then verify that setting hmacSecretData to false prevents resyncs after updates or operator restarts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100