AlinsRan commented on issue #2831:
URL:
https://github.com/apache/apisix-ingress-controller/issues/2831#issuecomment-6077777236
@jens-skribble
For now, the recommended approach is to sync the value from Vault into a
Kubernetes Secret with Vault Secrets Operator or External Secrets Operator, and
reference it from the plugin with `secretRef`. Secret keys can use dots for
nested fields, so `session.secret` is written to `openid-connect`'s
`session.secret`:
```yaml
apiVersion: v1
kind: Secret
metadata:
name: oidc-session # synced from Vault by VSO / ESO
stringData:
session.secret: "..."
---
plugins:
- name: openid-connect
enable: true
secretRef: oidc-session
config: { ... }
```
The controller watches referenced Secrets, so when the value is rotated in
Vault and the Secret is updated, the config is pushed again automatically.
Why `$secret://` is not being implemented in the controller for now:
- ADC does not support the `secrets` resource. It would first need to be
added as a resource type in ADC, and then the controller would need a new
resource model on top, so the change spans several components.
- The secret manager's own credentials (Vault token, AWS/GCP credentials)
would still have to live in a Kubernetes Secret, so sensitive data stays in
Kubernetes either way.
Limitations of the recommended approach: the plaintext value is present in
the Kubernetes Secret and in the config pushed to APISIX, and global plugins on
`GatewayProxy` do not support `secretRef`.
Closing this as not planned for now. If ADC gains support for the `secrets`
resource, or more users ask for the same thing, feel free to reopen.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
