infra/gcp: manage more secrets via bash #2078
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: spiffxp The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
sig/testing
|
/hold |
k8s-ci-robot
added
the
do-not-merge/hold
Specfically ensure_secret_with_admins, ensure_secret_labels
ensure_e2e_project could use some work but this is enough to break up the structure and address shellcheck nits
spiffxp
force-pushed
the
manage-secrets-via-bash
branch
from
c037ab8
to
e8fea9f
Compare
|
/hold cancel Changes in here have already been applied, the only thing that doesn't show up in the latest audit PR is the new group since that was too recent. |
k8s-ci-robot
removed
the
do-not-merge/hold
|
/lgtm |
k8s-ci-robot
added
the
lgtm
| # Eventually we would like to use kubernetes-external-secrets to manage | ||
| # all secrets in aaa; not sure how far we are on that. So for now, at least | ||
| # ensure that the existing kubernetes-public secrets created for humans | ||
| # to manually sync into the aaa cluster are managed by this script. |
There was a problem hiding this comment.
@spiffxp kubernetes-external-secrets is up and running. Before we switch to ExternalSecret, for each secret created in kubernetes-public we need to add a new version containing only the value of the data field instead of the whole Kubernetes Secret.
There was a problem hiding this comment.
I opened #2091, I couldn't find an umbrella issue for this at a glance but may have missed it
|
Related to : #516 |
This addresses a lot of #1731
And is motivated by kubernetes/test-infra#22293 and kubernetes/test-infra#22298. I'd like to get kubernetes-external-secrets up and running on k8s-infra-prow-build trusted, we're behind the way things are now done for prow.k8s.io