entur / helm-charts

0 stars 3 forks source link

same name, or option to set custom name, for k8s secrets using secret option #129

Closed Chr1stian closed 11 months ago

Chr1stian commented 11 months ago

From the example:

app: my-app-with-secrets
shortname: myapps
team: platform
env: dev

ingress:
  trafficType: api
  host: test.dev.entur.io

container:
  name: my-app
  image: theimage

secrets: # enables external-secrets
  secret-manager-secrets:  # name of k8s secret to be mounted
    - SECRET_ONE  # name of secret in secret manager

This generates the k8s secret with name my-app-with-secrets-secret-manager-secrets instead of just the expected secret-manager-secrets

AlexanderBrevig commented 11 months ago

The proposed solution to this is to automatically mount the <app>-secret-manager-secrets secret to the env of myapp. This way you do not need to concern yourself with the secret name until you're using kubectl, at which point you'll probably run a kubectl get secret anyway to see them all.

You may want to also have myotherapp in the my-app-with-secrets namespace, also with a secret-manager-secrets and so we need to avoid name collisions.

Another approach is to hand this responsibility over to our teams, but it will silently fail and make debugging presumably harder.

AlexanderBrevig commented 11 months ago

Will keep app prefix to avoid breaking changes and allowing multideploy to namespaces without race conditions for same name