[WIP] Support variable number of fernet keys #477
Conversation
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: afaranha The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
xek
changed the title
| "CredentialKeys0": keystone.GenerateFernetKey(), | ||
| "CredentialKeys1": keystone.GenerateFernetKey(), | ||
| } | ||
| for i := range instance.Spec.FernetKeys { |
There was a problem hiding this comment.
We need to check not only if the secret exists, but also generate extra keys if they are missing or delete extra keys.
This operation shouldn't rotate the keys, so the staged key (number 0) should stay as is, but the primary (the last key on the list) and secondary keys should be moved to the tail of the list of keys.
If the list in the secret exceeds the set number of keys, the keys in the middle should be deleted, compacting it, with the first key and the tail of the list having the same keys in the same order.
|
/test all |
|
These changes were merged in #478 |
|
PR needs rebase. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@afaranha: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@afaranha Hello! I think we should close this, right? |
4 participants
jira: OSPRH-10024