UNCLASSIFIED - NO CUI

Skip to content

Resolve "ClusterSecretStore Does Not Require A Namespace"

General MR

Summary

Removes the namespace from the ClusterSecretStore, since this Kind is not namespace aware.

Prior to this fix, the secretRef for the ClusterSecretStore and the final secret were required to be in the same namespace in order for ESO to work.

We move the namespace to be applied to the key references, so we can store the keys in a different namespace than the external-secret itself.

Relevant logs/screenshots

Test values:

apiVersion: v1
data:
  access-key: <REDACTED>
  secret-access-key: <REDACTED>
kind: Secret
metadata:
  name: aws-login
  namespace: external-secrets
    values:
      clusterSecretStoreConfiguration:
        enabled: true
        clusterSecretStoreList:
          - name: "team-sc-db"
            namespace: "external-secrets"
            labels: ""
            annotations: ""
            source: 
              provider: aws
              service: SecretsManager 
              region: "us-gov-west-1"
              refreshInterval: "20s"             
              auth:
                authType: "accesskey"  
                accessKeyName: "aws-login"
                accessKeyID: "access-key"
                secretAccessKey: "secret-access-key"
      externalSecretsConfiguration: 
        enabled: true
        secretList: 
          - name: "team-sc-db"
            namespace: "jira"
            secrets:
              secretKeyName:
                key: "jira-db-test-cred"
              targetName: "jira-db-secret"
              targetPolicy: "Owner"

If we want to store the aws-login secret in the external-secrets namespace:

Current Behavior:

image

image

With these fixes:

image

image

Linked Issue

For #100 (closed)

Upgrade Notices

n/a

Edited by Michael Martin

Merge request reports

Loading