Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add validating webhook #5

Open
terinjokes opened this issue Mar 2, 2021 · 1 comment
Open

add validating webhook #5

terinjokes opened this issue Mar 2, 2021 · 1 comment

Comments

@terinjokes
Copy link
Contributor

terinjokes commented Mar 2, 2021 •
edited
Loading

We should add a validating webhook to ensure the peer key is a known key for the cluster. We find that some teams have deployed lockboxes for one cluster into another, and are surprised when their secrets are not created. We should prevent this by returning an error during deployment.
@terinjokes
Copy link
Contributor Author

I can confirm that using the most recent CRDs (and the only open source versions) does prevent non-base64 secrets from being created with an, albeit verbose, error:

The Lockbox "top-secret" is invalid: spec.data.secret: Invalid value: "RatzHMvG5zRph50S4ZZgQrJ5pVqmDYBOrpuAhwQ5alz4mGF5+cT16Y9nxhAi+j9ots03/b9rcecNvIg==": spec.data.secret in body must be of type byte: "RatzHMvG5zRph50S4ZZgQrJ5pVqmDYBOrpuAhwQ5alz4mGF5+cT16Y9nxhAi+j9ots03/b9rcecNvIg==

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@terinjokes