Differently-scoped credentials per SecretRotator
Opened this issue · 1 comments
Is your feature request related to a problem? Please describe.
Scoped credentials.
Describe the solution you'd like to see
I would like the secrets provisioned for two different SecretRotators by the same operator to have two different authorization scopes.
SecretRotator A might put secret N in namespaces 1-5 that only provides authorization to pull image N-Y, and NOT authorized to pull image M-Z.
Meanwhile, SecretRotator B might put secret M in namespaces 6-10 that only provides authorization to pull image M-Z, and NOT authorized to pull image N-Y.
Describe alternatives you've considered
Multiple operators selecting specific SecretRotators by label.
Manual rotation.
Distinct optional attribute of each SecretRotator containing IAM Role ARN assumable by the operator's IRSA.
Additional context
Similar pattern to ExternalSecret operator which can use an assumable role attribute on SecretStore for AWS SecretsManager and ParameterStore providers.
HI @kennethredler,
Thank you for raising issue, we will look into and get back to you.