Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

IronicRunbook: allow step args to be loaded from a Secret via valueFrom.secretKeyRef

オープン
  • 何か問題がありますか？
#2,444 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
35/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
kubernetes, python
領域
backend, infrastructure, security

調査の方向性

Start in plugins/ironic/runbooks/reconcile.py and trace how IronicRunbook step args are copied and how cloudCredentialsRef Secrets are read. Inspect the CRD definition and existing reconcile tests or entry points to determine schema and error-handling conventions. Done means malformed or missing references fail clearly without exposing values, while valid references reach Ironic and the documented drift, rotation, and logging behavior is covered.

索引モデルが issue の本文から書いたものです。

説明

Problem

IronicRunbook step args are copied verbatim into the Ironic runbook
(plugins/ironic/runbooks/reconcile.py). Some steps need a sensitive value,
such as a token or password. Today the only way to provide one is to put it
in plain text in the CR spec, which means it ends up in git and anywhere the
manifest is rendered or displayed.

The CRD already references a Secret for cloudCredentialsRef, but nothing
equivalent exists for step arguments.

Proposal

Allow a step argument to be loaded from a Kubernetes Secret in the CR's
namespace, using the familiar valueFrom.secretKeyRef shape:

spec:
  steps:
  - interface: management
    step: some_step
    order: 1
    args:
      plain_arg: value
      sensitive_arg:
        valueFrom:
          secretKeyRef:
            name: my-secret
            key: some-key

At reconcile time the operator resolves each reference and sends the
resolved value to Ironic. The Secret itself can be populated by any means,
for example an ExternalSecret, so the sensitive value never needs to live
in the manifest.

Things to consider

  • Schema / CRD: args is currently free-form
    (x-kubernetes-preserve-unknown-fields). Decide whether to recognise
    valueFrom anywhere in args (including nested values) or only on
    top-level arguments, and reject a valueFrom that is malformed.
  • Missing Secret or key: fail the reconcile with a clear status
    condition and message rather than sending a partial runbook.
  • RBAC: the operator needs get on Secrets in the namespaces it
    reconciles. It already reads the cloudCredentialsRef Secret, so this may
    already be covered.
  • Rotation: the hook only watches the IronicRunbook kind, so a changed
    Secret is only picked up by the scheduled resync. Consider also binding on
    referenced Secrets, or document the resync interval as the propagation
    delay.
  • Drift detection: Ironic masks sensitive-looking values (for example
    keys containing token or password) as ****** when it returns runbook
    steps, so they never compare equal to the desired value and /steps is
    PATCHed on every reconcile. That already happens for literal values today
    (see the note in reconcile.py), but resolved secrets will make it more
    common. Comparing a hash of the resolved steps, stored in the ownership
    markers in extra, would avoid needless rewrites.
  • Logging and status: never write resolved values into operator logs,
    status messages or events.
  • Docs: note that the resolved value is still stored in Ironic's
    database as part of the runbook, so this protects the manifest, not
    Ironic.
主要言語
Python
スター
13
フォーク
11
平均マージ
1日 2時間
マージ済み PR（30日）
103

環境構築

  • Dockerfile・Docker Compose ファイルなし
  • プルリクエストのテンプレートあり
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

rackerlabs/understack のほかの issue

rackerlabs/understack の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。