feat: add secret lifetime field #908
Conversation
| /// Currently this property covers self signed certificates but in the future it may be extended to other | ||
| /// secret types such as Kerberos keytabs. | ||
| #[serde(default = "default_min_secret_lifetime")] | ||
| pub min_secret_lifetime: Duration, |
There was a problem hiding this comment.
question: Why do we use min_secret_lifetime here instead of just secret_lifetime to be inline with secrets.stackable.tech/backend.autotls.cert.lifetime?
question: Also, do we want it to be about all secrets? Or do we want to support scoped lifetimes for different types of (future) secrets? A more appropriate name would then be cert_lifetime for example.
There was a problem hiding this comment.
In the corresponding proposal I try to explain the reasoning for naming. Other suggestions are welcome though.
As you mention, the idea is that Pod restarts due to secret expiration should be easily understood and transparent from a user's perspective regardless of the type of secrets.
There was a problem hiding this comment.
As you mention, the idea is that Pod restarts due to secret expiration should be easily understood and transparent from a user's perspective regardless of the type of secrets.
Yeah that makes sense. On the other hand, I can see users wanting different lifetimes for different secrets (if there eventually will be multiple ones for a single group). So a less generic name might be something we have to think about.
Also, why do we prefix the field with min_? It is the lifetime of the secret, not a minimal lifetime which could be longer. Pods will get restarted at exactly at the lifetimes interval.
There was a problem hiding this comment.
Note: I'll link this discussion in the proposal.
|
closing as the corresponding proposal is rejected. |
Description
Part of: stackabletech/issues#586
Definition of Done Checklist