Expose secret keys in environment variables #18298
Conversation
|
Labelling this PR as size/L |
k8s-github-robot
added
kind/api-change
|
GCE e2e test build/test passed for commit 359c29429d89106f438c0b3ce917c215ec237ecd. |
| // Selects a field of the pod; only name and namespace are supported. | ||
| FieldRef *ObjectFieldSelector `json:"fieldRef,omitempty"` | ||
| // Selects a key of a secret in the pod's namespace | ||
| SecretKeyRef *SecretKeySelector `json:"secretKeyRef,omitempty"` |
There was a problem hiding this comment.
I assume once we have configData, there will be a 3rd line? Seems fine.
|
Should there be a validation that only one of the valueFrom options is non-nil? |
|
Seems like @bgrant0607 agreed with this approach in #4710. |
|
@erictune everything you pointed out i realized was a shortcoming of this PR after I started building another PR on top of it. I'll update w/ your feedback today. |
| return result, err | ||
| } | ||
| case envVar.ValueFrom.SecretKeyRef != nil: | ||
| runtimeVal, err = kl.secretKeySelectorRuntimeValue(envVar.ValueFrom.SecretKeyRef, pod) |
There was a problem hiding this comment.
it will probably be likely to use the same secret multiple times in a single pod (multiple keys, or one key in multiple containers)... pass something to secretKeySelectorRuntimeValue to let it avoid looking up the same secret multiple times per pod?
There was a problem hiding this comment.
doable, i will incorporate in my next pass through this code
k8s-github-robot
added
the
needs-rebase
bgrant0607
added
the
release-note
| // SecretKeySelector selects a key of a Secret. | ||
| type SecretKeySelector struct { | ||
| // The name of the secret in the pod's namespace to select from. | ||
| SecretRef LocalObjectReference `json:"secretRef"` |
There was a problem hiding this comment.
You could consider inlining LocalObjectReference.
|
Are you planning to rework this to be more like #18974 or should I review now? |
|
@erictune Okay, PR is re-cut and ready for review, PTAL. |
|
Actually, @erictune, I realize there is still an unhandled feedback item on this PR from you that I need to do. |
k8s-github-robot
removed
the
needs-rebase
|
GCE e2e test build/test passed for commit 394a7bb. |
|
GCE e2e test build/test passed for commit 60cf252. |
|
lgtm |
|
@k8s-bot unit test this please |
erictune
added
the
lgtm
|
@k8s-bot test this [submit-queue is verifying that this PR is safe to merge] |
|
GCE e2e test build/test passed for commit 60cf252. |
|
Automatic merge from submit-queue |
Auto commit by PR queue bot
Fixes #4710. @erictune @thockin
cc @resouer
cc @bgrant0607 for API changes