[Feature Suggestion] Support for watching secretproviderclasspodstatuses in addition to secrets and configmaps (CSI driver)

Question

[Feature Suggestion] Support for watching secretproviderclasspodstatuses in addition to secrets and configmaps (CSI driver)

dpkano opened this issue a year ago · comments

Hi,

Now that many projects are choosing to use CSI drivers to deliver their secrets into their workloads directly (as a file in the fs), a secret rotation does not involve K8s secrets. Whenever a new version of a secret is delivered via CSI driver, the object secretproviderclasspodstatuses.secrets-store.csi.x-k8s.io is updated with version information.

If Reloader watched these objects, we could still do a rolling upgrade of our workloads using Reloader when migrating to using CSI driver delivered secrets.

Would this community be interested in such feature?

Cheers,
Daniel

Dmitrii Kotov · Answer 1 · Mon Aug 14 2023 18:37:48 GMT+0800 (China Standard Time)

Agree, will be great to have this feature.

Arend Lapere · Answer 2 · Fri Oct 13 2023 22:25:55 GMT+0800 (China Standard Time)

Hi @dpkano , are you guys working on implementing this? Is there any help needed or something that can be worked on together? Having CSI support would be an imense help for all software that doesn't live check files for changes.

Kano · Answer 3 · Fri Oct 13 2023 23:35:39 GMT+0800 (China Standard Time)

Hi @UXabre, I've had a quick peek at the changes we need using Reloader. But, I think a simpler approach could be to use the Informer from the secretproviderclasspodstatuses to trigger a rolling upgrade for the controller (deployment, statefulset, daemonset, and more). This could be a neat short-term fix. If it pans out, I'll drop it on GitHub.