search

jfrog / jfrog-registry-operator

Enhancing AWS Security: JFrog's Seamless Integration and the Power of AssumeRole
https://jfrog.com
Apache License 2.0
21 stars 7 forks source link

Differently-scoped credentials per SecretRotator #24

Open kennethredler opened 2 months ago

kennethredler commented 2 months ago

Is your feature request related to a problem? Please describe.

Scoped credentials.

Describe the solution you'd like to see

I would like the secrets provisioned for two different SecretRotators by the same operator to have two different authorization scopes.

SecretRotator A might put secret N in namespaces 1-5 that only provides authorization to pull image N-Y, and NOT authorized to pull image M-Z.

Meanwhile, SecretRotator B might put secret M in namespaces 6-10 that only provides authorization to pull image M-Z, and NOT authorized to pull image N-Y.

Describe alternatives you've considered

Multiple operators selecting specific SecretRotators by label.

Manual rotation.

Distinct optional attribute of each SecretRotator containing IAM Role ARN assumable by the operator's IRSA.

Additional context

Similar pattern to ExternalSecret operator which can use an assumable role attribute on SecretStore for AWS SecretsManager and ParameterStore providers.

oumkale commented 1 month ago

HI @kennethredler,

Thank you for raising issue, we will look into and get back to you.