-
-
Notifications
You must be signed in to change notification settings - Fork 1.2k
[Suggestion] dataFrom for a directory #2987
Description
Is your feature request related to a problem? Please describe.
I manage the secrets in my Hashicorp Vault cluster using Terraform (for example creating AWS access keys, and then writing them to a vault secret).
My logical Vault layout is:
<cluster_name>/<application_name>/<secret_type>
Now, since I have multiple secret types, I must manage them separately (as I can't push them all in a single secret since Terraform will overwrite the data)
And since I want to inject all secret types of an application into it, I must manage an "externalSecret" resource per secret type (each with reference to the specific secret type name), and manually enable/disable secret types per application (as most applications don't require all secret types, and creating an ExternalSecret pointing to a non-existing secret will make it appear unhealthy).
TLDR - I have multiple secrets in the same directory, I want them all to dynamically get the same treatment (be injected into the same k8s secret), but have to manually specify each secret in my implementation.
Describe the solution you'd like
Best approach in my opinion, would be for "dataFrom" to support directories (instead of only final keys).
If provided path is a directory and not a key, get data from all secrets in this directory (maybe also add a "recursive" option?)
Example:
# Will pull data from all secrets under "test" directory
spec:
dataFrom:
- extract:
key: test/
# Will pull data from all secrets under test/object-storage secret (same as current behavior)
spec:
dataFrom:
- extract:
key: test/object-storage
Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
Possibly regex would be a solution - https://external-secrets.io/latest/guides/getallsecrets/