-
-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Documentation Update Regarding GitHub Provider's Write-only Behavior #5350
Description
Describe the bug
GitHub Provider when used as SecretStore or ClusterSecret supports PushSecret only or in an essentially one-way / write-only behavior. However, the documentation doesn't mention it and could lead to confusion.
To Reproduce
- Create a SecretStore or ClusterSecret store as mentioned in the documentation:
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
name: gh
spec:
provider:
github:
appID: 12345
installationID: 67890
organization: myorg
repository: myrepo
environment: myenv
auth:
privateKey:
namespace: x
name: y
key: key- Create an ExternalSecret that references the SecretStore or ClusterSecretStore
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: test-secret
namespace: myns
spec:
data:
- remoteRef:
key: TEST_SECRET
secretKey: test-secret
refreshInterval: 1m
secretStoreRef:
kind: ClusterSecretStore
name: gh
target:
creationPolicy: Owner
name: test-secretExpected behavior
The remote secret on GitHub should be successfully sync to the cluster.
Actual Behavior
The ExternalSecret object was created but with an sync error not implemented - this provider supports write-only operations
Additional context
The SecretStore / ClusterSecret store when created with the GitHub provider will have a the following status:
status:
capabilities: WriteOnly
Even though one could read the GitHub API Documentation and see that there is no endpoint to fetch the actual secret value, the documentation of External Secrets regarding the GitHub provider should be updated to explicitly mention that the GitHub provider supports only write-only operations.
Metadata
Metadata
Assignees
Labels
Type
Projects
Status