search

hashicorp / vault-secrets-operator

The Vault Secrets Operator (VSO) allows Pods to consume Vault secrets natively from Kubernetes Secrets.
https://hashicorp.com
Other
430 stars 89 forks source link

Add ability to ignore certain labels/annotations (or only check relevant ones) #839

Open com6056 opened 3 days ago

com6056 commented 3 days ago

Describe the bug A clear and concise description of what the bug is.

As of https://github.com/hashicorp/vault-secrets-operator/pull/576, it seems like any label/annotation change is causing our dynamic secrets to roll and trigger a rollout restart for the affected rollable objects. We should either add an exclude list of labels/annotations that won't trigger a reconcile, or we should only be checking relevant labels/annotations in labelChangedPredicate and annotationChangedPredicate.

To Reproduce Steps to reproduce the behavior:

  1. Change any annotation on a VaultDynamicSecret
  2. See a rollout restart trigger