Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

IronicRunbook: allow step args to be loaded from a Secret via valueFrom.secretKeyRef

未关闭
  • 哪里不对？
#2,444 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
kubernetes, python
领域
backend, infrastructure, security

调研方向

Start in plugins/ironic/runbooks/reconcile.py and trace how IronicRunbook step args are copied and how cloudCredentialsRef Secrets are read. Inspect the CRD definition and existing reconcile tests or entry points to determine schema and error-handling conventions. Done means malformed or missing references fail clearly without exposing values, while valid references reach Ironic and the documented drift, rotation, and logging behavior is covered.

由索引模型根据 Issue 内容生成。

描述

Problem

IronicRunbook step args are copied verbatim into the Ironic runbook
(plugins/ironic/runbooks/reconcile.py). Some steps need a sensitive value,
such as a token or password. Today the only way to provide one is to put it
in plain text in the CR spec, which means it ends up in git and anywhere the
manifest is rendered or displayed.

The CRD already references a Secret for cloudCredentialsRef, but nothing
equivalent exists for step arguments.

Proposal

Allow a step argument to be loaded from a Kubernetes Secret in the CR's
namespace, using the familiar valueFrom.secretKeyRef shape:

spec:
  steps:
  - interface: management
    step: some_step
    order: 1
    args:
      plain_arg: value
      sensitive_arg:
        valueFrom:
          secretKeyRef:
            name: my-secret
            key: some-key

At reconcile time the operator resolves each reference and sends the
resolved value to Ironic. The Secret itself can be populated by any means,
for example an ExternalSecret, so the sensitive value never needs to live
in the manifest.

Things to consider

  • Schema / CRD: args is currently free-form
    (x-kubernetes-preserve-unknown-fields). Decide whether to recognise
    valueFrom anywhere in args (including nested values) or only on
    top-level arguments, and reject a valueFrom that is malformed.
  • Missing Secret or key: fail the reconcile with a clear status
    condition and message rather than sending a partial runbook.
  • RBAC: the operator needs get on Secrets in the namespaces it
    reconciles. It already reads the cloudCredentialsRef Secret, so this may
    already be covered.
  • Rotation: the hook only watches the IronicRunbook kind, so a changed
    Secret is only picked up by the scheduled resync. Consider also binding on
    referenced Secrets, or document the resync interval as the propagation
    delay.
  • Drift detection: Ironic masks sensitive-looking values (for example
    keys containing token or password) as ****** when it returns runbook
    steps, so they never compare equal to the desired value and /steps is
    PATCHed on every reconcile. That already happens for literal values today
    (see the note in reconcile.py), but resolved secrets will make it more
    common. Comparing a hash of the resolved steps, stored in the ownership
    markers in extra, would avoid needless rewrites.
  • Logging and status: never write resolved values into operator logs,
    status messages or events.
  • Docs: note that the resolved value is still stored in Ironic's
    database as part of the runbook, so this protects the manifest, not
    Ironic.
主要语言
Python
星标
13
派生
11
平均合并
16 小时 16 分钟
30 天内合并 PR
131

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

rackerlabs/understack 的其他 Issue

查看 rackerlabs/understack 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。