Open ckav370 opened 1 month ago
Isn't this already possible?
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
annotations:
argocd.argoproj.io/hook: PreSync
argocd.argoproj.io/sync-wave: "-1000"
We already use ExternalSecrets in this fashion. One of our PreSync jobs requires a secret present and this was our strategy to prevent the catch 22 of initial sync not having that secret defined yet.
Isn't this already possible?
apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: annotations: argocd.argoproj.io/hook: PreSync argocd.argoproj.io/sync-wave: "-1000"
We already use ExternalSecrets in this fashion. One of our PreSync jobs requires a secret present and this was our strategy to prevent the catch 22 of initial sync not having that secret defined yet.
Using a PreSync jon in this way means that when the secret is updated, the secret will be recreated. In the case where some PreSync job and the main application uses this secret, this would not be a very robust- especially in the case where the secret refresh failed to pull from the ExternalSecret backend.
Granted this is probably more likely in legacy code bases, but it would not be a solution for my current use case :)
I want to be able to use a
preSync
hook to run some database migrations. This has been working fine, until such a time as updating the container secrets which are using the External Secret Operator and CRD to create a k8s secret which the job created by thepreSync
hook creates mounts.As per this Github issue #9891, the recommended approach is to use Argo sync waves. However
ExternalSecret
is not included in one of the predefinedkinds
and therefore cannot be part of a different "wave" meaning that any secrets defined byExternalSecrets
cannot be synced before thepreSync
hook as part of the pre Sync wave.This would allow the
ExternalSecret
to have an annotation such as the followingAnd a
preSync
hook to have a greater weighted sync wave such asAnd all other resources which are part of the deployment would default to weight of
0
without the need for an annotation