-
Notifications
You must be signed in to change notification settings - Fork 404
Cache Vault clients/tokens on a per-role&mountpoint basis. #488
Conversation
Lovely. This will solve the issue I am currently facing. Guessing other folks would want this as it follows vault policy per role. |
Some conflicts after #472 merge, mind resolving? |
I can't explain why the E2E tests are failing here (they were passing before this merge and the changes are extremely minimal) whilst the unit tests are passing. Tried numerous things (will tidy up afterwards) but e2e still returning error code 1. Seems they're broken in the README.md update PR here too #490 By the way, we are running the pre-merge code on our production cluster with good outcomes. |
Yeah don't think E2E tests are related to this PR, seems to be failing everywhere but I cant really tell why <_< |
Should I just tidy up the commits (rebase) in preparation for merge or do the e2e tests need sorting first? |
I dont have the rights to merge without the E2E tests passing anyway so :) and all merges are squash as well. But I'll try pinging someone on slack. |
E2E tests have been restored and should be working after a rebase :) |
All good now 👍 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Fixes #487
When you have a single k8s cluster with multiple namespaces and each
ExternalSecret
is defined with a very limited scopedvaultRole
(limiting the vault data that role can read) the existing token caching causes issues.This change caches each
vaultClient
against thevaultRole
it's authenticated against and can therefore KES can read all the secrets it is meant to regardless of how manyvaultRoles
are defined across your ExternalSecrets