You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently this runs as a kubernetes controller which is great because when a new secret is added the controller reacts and grabs the secret data from Google's Secret Manager (GSM). One problem with this is if a new secret version is created in GSM the controller doesnt update the k8s secret value because it's watching the k8s resources not GSM.
As an alternative to running the controller all the time and using resources when not needed we could run this as a k8s CronJob so that periodically it queries GSM and updates the k8s secrets. Any pod that has the secret mounted automatically gets the new data without needing to restart.
This seems like a good option to offer.
The text was updated successfully, but these errors were encountered:
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://jenkins-x.io/community.
/lifecycle stale
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://jenkins-x.io/community.
/lifecycle stale
Currently this runs as a kubernetes controller which is great because when a new secret is added the controller reacts and grabs the secret data from Google's Secret Manager (GSM). One problem with this is if a new secret version is created in GSM the controller doesnt update the k8s secret value because it's watching the k8s resources not GSM.
As an alternative to running the controller all the time and using resources when not needed we could run this as a k8s CronJob so that periodically it queries GSM and updates the k8s secrets. Any pod that has the secret mounted automatically gets the new data without needing to restart.
This seems like a good option to offer.
The text was updated successfully, but these errors were encountered: