kubeworks/kube-yaseg
Watch
1
0
Fork
You've already forked kube-yaseg
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore!: minor fixes here and there & move CRDs into submods & introduce serializer helpers

Browse source
This commit is contained in:
spushk 2026-06-02 06:10:46 +05:00 • committed by spushk
commit 3ac37809b7
Signed by: spushk
GPG key ID: 7797B761E105E8AA
1 changed files with 811 additions and 1543 deletions
Download patch file Download diff file Expand all files Collapse all files

29
README.md
View file

@ -90,7 +90,8 @@ Both resources inherit namespace and name (as prefix) from `RandomSsh` resource
> ⚠️ This feature exists primarily for testing purposes, where security is less of a concern then repeatability.
>
> While there are use-cases for predictable secrets in production, you should consider [ESO](https://external-secrets.io)
> While there are use-cases for predictable secrets in production (e.g. DB credentials in some cases),
> you should consider [ESO](https://external-secrets.io)
> with secure external storage to share secrets between clusters and keep secrets stable.
>
> If the seed secret gets compromised - every past and future generated secret can be easliy computed.
@ -126,6 +127,24 @@ Secret values generated by deterministic generator depend on:
Thus, if seed secret remains stable and DeterministicSecret specification does not change - generated keys remain stable and predictable
To set the `seed` for the controller, deploy a `v1/Secret` and target the controller to it with `KUYASEG_DETERMINISTIC_SEED` env variable.
```yaml
apiVersion: v1
kind: Secret
metadata:
name: controller-seed
namespace: testing
stringData:
my_seed: aabbcc123
```
`KUYASEG_DETERMINISTIC_SEED=controller-seed/my_seed`
When the later part `/my_seed` is omitted, controller will expect the `seed` key to contain seed value.
When the seed *value* changes, all known secrets are reconciled.
## Feature comparison
We know there are plenty of decent, mature and well-adopted solutions like the one by [mittwald](https://github.com/mittwald/kubernetes-secret-generator) and even [ESO](https://external-secrets.io) which can also generate secrets.
@ -156,11 +175,11 @@ To produce random secrets (`RandomSecret`, `RandomSshSecret`), operator uses [aw
To produce deterministic secrets (`DeterministicSecret`, `DeterministicSsh`), operator uses [Hc128](https://docs.rs/rand_hc/latest/rand_hc/) CSPRNG.
### Secret persistence & memory
### Secret persistence
Random secrets defined by `RandomSecret` and `RandomSsh` are unstable. Deletion of generated `Secret` will lead to new random value on next reconcilation.
Random secrets defined by `RandomSecret` and `RandomSsh` are unstable: deletion of generated `Secret` will produce new random value on next reconcilation.
Deterministic secrets defined by `DeterministicSecret` and `DeterministicSsh` are stable as long as the base `seed` remains unchanged.
Deletion of generated `Secret` resources will lead to the same pseudo-random value put into the secret on next reconcilation as long as spec remains the same.
Deterministic secrets defined by `DeterministicSecret` and `DeterministicSsh` are stable as long as the base `seed` and spec/version remain unchanged.
Deletion of generated `Secret` resources will lead to the same pseudo-random value put into the secret on next reconcilation.
Best effort is taken to ensure that secrets do not remain in memory longer then needed and/or after crush.