Svidstore gcp region #5718
Svidstore gcp region #5718
Conversation
Signed-off-by: Jens Hörnström <[email protected]>
Signed-off-by: Jens Hörnström <[email protected]>
jenshornan
requested review from
evan2645,
amartinezfayo,
azdagron,
MarcosDY and
rturner3
as code owners
Signed-off-by: Jens Hörnström <[email protected]>
Co-authored-by: Sorin Dumitru <[email protected]> Signed-off-by: jenshornan <[email protected]>
Signed-off-by: Jens Hörnström <[email protected]>
|
Sorry for failing test. Should be fixed now. |
| Automatic: &secretmanagerpb.Replication_Automatic{}, | ||
| }, | ||
| }, | ||
| Replication: opt.replication, |
There was a problem hiding this comment.
This is only done if the secret is not found. If a secret already exists and the list of locations changed, then we wouldn't be updating the secret with the new list. We probably need to call UpdateSecret in those cases.
There was a problem hiding this comment.
Although I see that the replication cannot be changed after the secret has been created, based on the comments in https://pkg.go.dev/cloud.google.com/go/[email protected]/apiv1/secretmanagerpb#Secret.
I don't know if deleting and recreating it would work, if it doesn't we'd need to at least log something to inform the user.
There was a problem hiding this comment.
@MarcosDY What do you think, should we attempt to delete and recreate? That might end up being bad user experience, i imagine the secret with the X509-SVID will dissapear for a short amount of time.
There was a problem hiding this comment.
That is a possibility. I do think Replication field is immutable. So in the case someone change it we will need to destroy and then re-create the secret with the new location setting.
Dont know do if appending more regions to the list of regions would be possible as an update...
Maybe easier to just destory and re-create in both cases?
I can look in to it.
There was a problem hiding this comment.
Sorry did not refresh so I missed you follow up comment will wait for a decision. Also to take in to consideration is that it might create IAM problems for the user.
Signed-off-by: Jens Hörnström <[email protected]>
Pull Request check list
Affected functionality
Now you are able to specify the region the secret gets created in
Description of change
Add new selector called region. If no region selector is given it will be the old behavior to create a global secret.
Which issue this PR fixes
fixes #5717