stackabletech / stackabletech/secret-operator
SecretClass access control
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 13
- Forks
- 8
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 10
Description
We should have a way to control who's allowed to mount which SecretClass.
It's not really practical to control based on the deploying user, because the idea of a "source user" in the first place is about as clear as mud in K8s (the end user creating the StatefulSet? The controller creating the Pod from that? The controller creating the PersistentVolumeClaim from that? The controller creating the PersistentVolume from that?).
The best we could do would probably be to allowlist individual target Namespaces.
This is theoretically already possible via a K8s admission hook like OPA; we should either implement something native or document how to accomplish it using one of those.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Kubernetes admission control extension points and the linked OPA Kubernetes documentation. Clarify whether the project should provide native SecretClass access control or document an admission-hook approach, and define how an allowlist of target Namespaces would work. Done means the chosen approach and its scope are explicitly specified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100