search

mittwald / kubernetes-secret-generator

Kubernetes controller for automatically generating and updating secrets
Apache License 2.0
330 stars 57 forks source link

Use MutatingWebHook for generating secrets #28

Open ludydoo opened 3 years ago

ludydoo commented 3 years ago

Is your feature request related to a problem? Please describe.

It's a feature request, to prevent potential race condition problems. The current implementation seems to be watching secrets in certain or all namespaces.

The problem is that a secret that is created might be attached to pods using environment variables (valueFrom: ...). But, at the time of being attached, the generator might not yet generate the required secret keys.

So there is a situation where a pod could be attached to a secret before the values are actually generated.

Describe the solution you'd like

By using a MutatingWebHook, the secret keys would be generated before the secret is available to pods.

The MutatingWebHook lifecycle will be triggered before the secret could be admitted, and it would prevent this race condition altogether.

Describe alternatives you've considered

Restart the pod if the key is not present on the secret

mittwald-machine commented 3 years ago

There has not been any activity to this issue in the last 30 days. It will automatically be closed after 7 more days. Remove the stale label to prevent this.

martin-helmich commented 3 years ago

Since this is already getting stale...

Thanks for the suggestion, and :+1: from me on the general idea -- this would completely eliminate the (however short) period in which a required secret value would be missing and save us all the reconciliation loops.

However, since this is quite a major change, I cannot make any promises as to if and when we'd be getting to building this. As usual, any PRs in this matter are most welcome.

usamaahmadkhan commented 2 years ago

FYI: @ludydoo Use Reloader to tackle this problem generally