Skip to content

feat/fix: support multiple keys on same path for random secret#300

Open
13bscsaamjad wants to merge 1 commit intoredhat-cop:mainfrom
13bscsaamjad:random-secret-support-multiple-keys
Open

feat/fix: support multiple keys on same path for random secret#300
13bscsaamjad wants to merge 1 commit intoredhat-cop:mainfrom
13bscsaamjad:random-secret-support-multiple-keys

Conversation

@13bscsaamjad
Copy link
Contributor

RandomSecret controller to support multiple secrets on same Vault path

Problem

Vault allows for multiple secrets on same path. RandomSecret controller has issue for when resources pointed to the same Vault path (via spec.name override), only the first resource would create its secret. Subsequent resources would reconcile successfully but won't create their secrets in Vault, leading to confusing behavior where the resource showed no errors but the expected secret was missing.

Solution

  • Added CreateOrMergeKV method to merge new keys (secrets) into existing Vault secrets instead of skipping creation.
  • Resources pointing to same path now read existing secret data and merge their key, allowing multiple RandomSecret CRDs to contribute different keys (secrets) to the same Vault path (e.g., one for password, another for username ...).
  • Added integration tests covering multi-key scenario.

The changes are backward compatible and works with both KV v1 and KV v2 secret engines.

Solves #234 with an approach without breaking changes.

@13bscsaamjad
Copy link
Contributor Author

@raffaelespazzoli if you can review this? Thanks in advance!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant