Closed AlexanderStocks closed 2 days ago
Thanks for raising the issue @AlexanderStocks.
The SecretsProviderClass (SPC) serves as the common interface between the Secrets Store CSI Driver
and the Secrets Store Sync Controller
. Although we expect a 1:1 mapping for secrets between SecretsSync and SPC, there is no such requirement when SPC is used in the Secrets Store CSI driver. Users can define multiple secrets they want to fetch from an external key vault and mount on the volume.
In SecretsSync, you can define only one secret that needs to be created as a Kubernetes Secret. Given this 1:1 mapping, is there a specific reason you are defining multiple secrets in SPC?
/assign
@AlexanderStocks, We discussed this in the community call on 09/05. Another thing to consider is that SecretsSync does not have an understanding of how secrets are defined in the SPC. It’s just a map that can be defined however individual providers want to implement or consume it from the SPC.
The recommendation here is:
/close
@nilekhc: Closing this issue.
Currently in the controller we fetch all secrets in a
SecretProviderClass
from the provider each time we reconcile aSecretSync
. This can have a large impact in costs from providers and is an inefficiency.Describe the solution you'd like I would like to only fetch the secret referenced in the secret sync that we are reconciling.
Environment: