sealed-secrets: Annotations/Labels missing in sealed secrets resource metadata
Pipe a secret into kubeseal results in a sealed secrets resource without any annotations/labels at sealedsecrets.metadata.labels /sealedsecrets.metadata.labels.
Expected:
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
annotations:
app: my-app # used from secret.metadata.annotations
labels:
app: my-app # used from secret.metadata.labels
name: my-token
namespace: my-namespace
spec:
... # the rest is fine
The missing labels in particular prevents me from applying sealed secrets objects with kubectl + labelselector option (whats also needed for whitelist pruning).
About this issue
- Original URL
- State: closed
- Created 4 years ago
- Reactions: 1
- Comments: 18
@juan131 this is not a duplicate of #403 in this Issue here it is talked about adding labels/annotations that are on the secret automatically also to the sealedSecret.
As far as I see 403 it is a bug where the sealedSecret is missing to set some labels inside the secret? So the other way around.
It would even be nice to have a way to use
kubeseal
to directly annotate or label the sealed secrets--annotate
or--label
to the command allowing to directly to apply annotations and labels to the sealedSecret when generating them.This can be very usefully actually, especially for argocd solution;
I really need the annotations
argocd.argoproj.io/hook:
andargocd.argoproj.io/sync-wave
to exist on the sealedsecret resource, allowing argocd to deploy it FIRST before migration jobs.