fix(server-nestjs): reuse Vault AppRole secret-id instead of minting on every sync - #2626
Draft
shikanime wants to merge 2 commits into
Draft
fix(server-nestjs): reuse Vault AppRole secret-id instead of minting on every sync#2626shikanime wants to merge 2 commits into
shikanime wants to merge 2 commits into
Conversation
shikanime
force-pushed
the
fix/argocd-secret-id-idempotent
branch
from
August 28, 2026 11:41
2e374ba to
297676a
Compare
Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr> Change-Id: Iff465b31836b84656a084678aeec082a6a6a6964
…on every sync Refs #2622 Co-authored-by: Automata <automata@shikanime.studio> Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr> Change-Id: Ie3d3b7df1e0539c02d6a215ce7eff82a6a6a6964
shikanime
force-pushed
the
fix/argocd-secret-id-idempotent
branch
from
August 28, 2026 14:20
297676a to
e61aa06
Compare
|
0 New Issues
0 Fixed Issues
0 Accepted Issues
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issues liées
Quel est le comportement actuel ?
À chaque synchronisation (project.upsert, cron),
generateVaultValuesappellecreateAuthApproleRoleSecretId, qui émet un nouveau secret-id AppRole viaPOST auth/approle/role/{role}/secret-id. Le secret-id n'est ni relu ni réutilisé : il s'accumule dans Vault à chaque exécution, et son renouvellement systématique rend la diff de contenu desvaluestoujours sale, d'où un nouveau commitvalues.yamlà chaque passage même sans changement de configuration.Comportement attendu
Le secret-id est idempotent : une seconde synchronisation sans changement de configuration ne produit ni nouveau secret-id ni nouveau commit
values.yaml. Le role-id continue d'être relu via GET (chemin inchangé).Changements
createAuthApproleRoleSecretIddevient un get-or-create : il relit un secret-id persisté dans le KV Vault du projet ; s'il existe, il le réutilise, sinon il le crée puis le persiste.APPROLE_SECRET_ID(aux côtés des autres identifiants du projet).