Operator no longer includes annotations within the created secret

[tomjohnburton]

Your environment

Operator Version: v1.6.0

Connect Server Version: 1.5.7

Kubernetes Version: 1.23.9

What happened?

In version 1.3.0 of the operator, any annotation I added to the operator would be propagated to the resulting secret. Now, none of my annotations are added.

What did you expect to happen?

I expected the resulting secret to have the annotations I set

Steps to reproduce

1. Create a OnePasswordItem with annotations
2. Deploy
3. Validate the resulting secret doesn't have annotations
4. Use v1.3.0 of the operator
5. Do steps 1-3
6. Validate annotations are there

Notes & Logs

kind: OnePasswordItem
metadata:
  annotations:
    argocd.argoproj.io/compare-options: IgnoreExtraneous
    kubed.appscode.com/sync: "true"

kind: Secret
metadata:
  annotations:
    operator.1password.io/item-path: vaults/***/items/***
    operator.1password.io/item-version: "3"

[tomjohnburton]

I see the commit where it was changed
afa076d

IMO, we should allow users to add extra annotations.

One option could be to add a template field to the spec. A common practise among the k8s community

kind: OnePasswordItem
metadata:
	name: xyz
spec:
	template:
		  annotations:
		     argocd.argoproj.io/compare-options: IgnoreExtraneous
		     kubed.appscode.com/sync: "true"
			

[edif2008]

Thank you for raising this with us.
We will further investigate this on our side and come back to you.

[vjm]

Hi, any progress on this, or a workaround perhaps using kustomize?

[tomjohnburton]

I forked it and added the functionality back
https://github.com/tomjohnburton/onepassword-operator

[amaldonadomat]

Any updates on this @edif2008 ?
It's still happening on versions:
Operator Version: 1.8.0
Connect Server Version: 1.7.2

[Tipsmark]

Still not fixed? Come on....

[olivier-duchaine]

Hi folks, is there a plan to implement this in the near future? As said by OP it used to work but was reverted on afa076d.

Our use case is for argocd secrets, it uses labels to pick up the different types of secrets.

thanks

[gianmarco-mameli]

Hi, me too I'd like to have the functionality back for using it on argocd

[ruslanguns]

This is a mess. First, the functionality was there, then it was removed. Personally, there should be a way to dynamically provision labels from the OnePasswordItem object to the secrets it generates. This case has been open for a long time now. What is the plan? Can someone respond?

[xTrekStorex]

We also rely on this and just noticed it no longer works for new secrets.
E.g. jenkinsci/kubernetes-operator relies on annotations and labels to configure credential type, usage and custom options.
So far we provided those with the OnePasswordItem.

[pniederlag]

not being able to control the outcome of the processing by forcing some policey that might but does necessarily makes sense makes 1password integration useless/dangerous in some valid use-cases.