ricoberger / vault-secrets-operator

Create Kubernetes secrets from Vault for a secure GitOps based workflow.
MIT License
633 stars 103 forks source link

Add support to auto requeue secrets #187

Closed pannoi closed 1 year ago

pannoi commented 1 year ago

This PR updates CRD to have additional field to autoRequest (bool) secrets from Vault

Problem statement

If you deploy secrets with VaultSecret CR and then update version of secret in Vault then secret won't be automatically updated. To apply secret you need to force apply changes (In ArgoCD force sync-up) Tested with:

Changes

Comments

This small bug lil bit ruins auto GitOps approach and keep relying on human that they will force update CR/Secret. Also would be really valuable and convenient if people are having auto-rotation scripts

ricoberger commented 1 year ago

Hi @pannoi and thanks for your contribution 🙂.

Why can you not use the vault. reconciliationTime value from the Helm chart (or the corresponding environment variable VAULT_RECONCILIATION_TIME), to automatically reconcile the secrets after the specified time?

pannoi commented 1 year ago

Yeah, looks like missed it or was not working before, sorry and thanks. Now issue with auto reconciliation works, PR might be closed