-
Notifications
You must be signed in to change notification settings - Fork 297
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: Use RequiresRepublish for secret rotation #1622
base: main
Are you sure you want to change the base?
Conversation
Hi @dargudear-google. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Approach broadly LGTM! IIUC, once this PR is submitted, auto-rotation won't work for k8s clusters < 1.21. What is the process to announce and manage this breaking change?
Discussed in the last community call that we should publish that "For clusters < 1.21, please use v.1.4.5 or earlier." |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1622 +/- ##
==========================================
- Coverage 35.83% 31.01% -4.82%
==========================================
Files 63 57 -6
Lines 3759 3205 -554
==========================================
- Hits 1347 994 -353
+ Misses 2268 2108 -160
+ Partials 144 103 -41 ☔ View full report in Codecov by Sentry. |
/ok-to-test |
aa6ffcb
to
8d332b7
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
First pass.
In bats tests, where sleep duration/timeout is increased, could you re-evaluate if it's necessary? If yes then could you add a note to make sure we have context?
/retest-required |
/retest |
1 similar comment
/retest |
e2a9372
to
71c2fee
Compare
/retest |
1 similar comment
/retest |
/unassign nilekhc |
[[ "${result//$'\r'}" == "BeforeRotation" ]] | ||
|
||
# After a minute, mounted secret should be rotated | ||
sleep 60 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The rotation poll interval is 30s and we already sleep for 30s before, shouldn't this be shorter to see the rotation happen?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
With requires republish minimum rotation time would be 1 minute + jitter.
sleep 40 | ||
|
||
# Secret rotation is not immediate. So even after 30 seconds, older secret should be there. | ||
sleep 30 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The rotation interval is 30s, so can this cause the test to flake?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Minimum rotation time will be 1 minute + jitter so it won't be rotated before 30 sec
@@ -91,7 +100,7 @@ teardown_file() { | |||
[[ "${result//$'\r'}" == "BeforeRotation" ]] | |||
|
|||
aws secretsmanager put-secret-value --secret-id $SM_ROT_TEST_NAME --secret-string AfterRotation --region $REGION | |||
sleep 40 | |||
sleep 120 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
why 120?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
rotation time is 1 minute + jitter. To avoid any flakiness from jitter part, used 120 seconds.
/retitle feat: Use RequiresRepublish for secret rotation |
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dargudear-google The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
9ca55a9
to
a7f4796
Compare
acf1519
to
23e8f92
Compare
@dargudear-google: The following tests failed, say
Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Remove the rotation controller and rely exclusively on RequiresRepublish for secret rotation.