stackabletech / stackabletech/superset-operator
Allow secretKey rotations
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 35
- Forks
- 4
- Avg merge
- 12h 20m
- Merged PRs (30d)
- 10
Description
Current Situation
According to superset docs on secretKeys you should be able to rotate keys to encrypt your database and session cookies.
Currently you'd need to manually add PREVIOUS_SECRET_KEY and add the new SECRET_KEY env variable ( while reconciliation paused ) and run superset re-encrypt-secrets on your own in pod. When succeeded, you can unpause reconciliation and add the new SECRET_KEY to your superset_credentials secret.
Proposal
The operator should be able at reconciliation to decide weather to re-encrypt. Ideally, we can automatically rotate this key.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the reconciliation flow that manages SECRET_KEY and the documented superset re-encrypt-secrets command. Trace how PREVIOUS_SECRET_KEY and the superset_credentials secret are currently handled during reconciliation. Done should include a decided and implemented rotation workflow that re-encrypts secrets safely without requiring manual reconciliation pauses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes, rust
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100