feat: Add poll-based secret synchronization with configurable sync interval#167
feat: Add poll-based secret synchronization with configurable sync interval#167gouthamMN wants to merge 3 commits intokubernetes-sigs:mainfrom
Conversation
…terval
Adds support for automatic, periodic secret synchronization from external
providers using a configurable sync interval. This enables secrets to be
automatically updated when they change in the external secret store without
requiring manual updates to the SecretSync resource.
Key Changes:
- Added optional `syncInterval` field to SecretSyncSpec allowing users to
configure polling frequency (e.g., "5m", "10m", "1h")
- Implemented automatic requeuing in the controller with configurable interval
- Added validation for sync interval with min (1m) and max (24h) constraints
- Maintained backward compatibility - secrets without syncInterval continue
to sync only on resource create/update (existing behavior)
Implementation Details:
- Controller fetches secrets from provider on each reconciliation cycle
- When syncInterval is set, controller requeues after the specified duration
- Hash-based change detection ensures secrets are only updated when data changes
- Status conditions and lastSuccessfulSyncTime are updated on each sync
Testing:
- Added unit tests for sync interval validation and requeue logic
- Added e2e test verifying secret creation with sync interval configured
- All existing tests pass, confirming backward compatibility
- Tested with minimum interval (1m) in e2e environment
Examples:
```yaml
apiVersion: secret-sync.x-k8s.io/v1alpha1
kind: SecretSync
metadata:
name: my-secret
spec:
serviceAccountName: default
secretProviderClassName: my-provider
syncInterval: "10m" # Poll every 10 minutes
secretObject:
type: Opaque
data:
- sourcePath: foo
targetKey: bar
```
Related: Addresses user feedback for automatic secret rotation and updates
without requiring CSI driver mounts or manual resource updates.
Signed-off-by: Goutham Niranjan goutham.mn034@gmail.com
k8s-ci-robot
added
the
needs-triage
|
This issue is currently awaiting triage. If secrets-store-sync-controller contributors determine this is a relevant issue, they will accept it by applying the The DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: gouthamMN The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Welcome @gouthamMN! |
|
Hi @gouthamMN. Thanks for your PR. I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
needs-ok-to-test
- Sync intervals persist across controller crashes/restarts by checking LastSuccessfulSyncTime - Failed condition retries continue to bypass interval (immediate retry) - Hash changes (SPC/SS updates, force sync) continue to trigger immediate sync - Periodic polling only syncs when configured interval has elapsed Signed-off-by: Goutham Niranjan goutham.mn034@gmail.com
- Refactor the Reconcile function to reduce cyclomatic complexity from 37 to below the 30 threshold by extracting logic into helper functions - Pass failedCondition by pointer to avoid heavy struct copying (96 bytes) - Fix Helm chart templates to safely handle nil providerContainer values by splitting compound condition into nested checks - Apply gofmt formatting to all affected files Signed-off-by: Goutham Niranjan goutham.mn034@gmail.com
|
/triage accepted |
|
@gouthamMN: The label DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
What type of PR is this?
/kind featureWhat this PR does / why we need it:
Adds support for automatic, periodic secret synchronization from external providers using a configurable sync interval. This enables secrets to be automatically updated when they change in the external secret store without requiring manual updates to the SecretSync resource.
Key Changes:
syncIntervalfield to SecretSyncSpec allowing users to configure polling frequency (e.g., "5m", "10m", "1h")Implementation Details:
Testing:
Examples:
Related: Addresses user feedback for automatic secret rotation and updates without requiring CSI driver mounts or manual resource updates.
Signed-off-by: Goutham Niranjan goutham.mn034@gmail.com