area/securitydesign/reviewhelp wantedpriority/highskill/intermediate
Métriques du dépôt
- Stars
- (770 stars)
- Métriques de merge PR
- (Aucune PR mergée en 30 j)
Description
Expected Behaviour
When a secret is no longer bound to a function it should be reclaimed
Current Behaviour
These are removed manually
Possible Solution
Initially perhaps we could reclaim SealedSecrets on a periodic basis via cron / kubectl? this would cause the SealedSecrets controller to remove the Secret from Kubernetes.
We may also want to look into updating import-secrets so that it can remove as well as create SealedSecrets. Alternatively garbage-collect may need extending.
Please make some suggestions on pros/cons before working on this.
Also in scope is documenting the behaviour when complete in the docs/README.md file.
Steps to Reproduce (for bugs)
- Add a SealedSecret to your repo and function
- Deploy function and check it can access the secret
- Remove the secret from the repo (this does another push and the new version of the function will have no secrets attached, but the secret will still exist)