-
Task
-
Resolution: Done
-
Major
-
None
-
None
-
False
-
None
-
False
-
Not Started
-
Not Started
-
Not Started
-
Not Started
-
Not Started
-
Not Started
-
-
-
RHOAM Sprint 64, RHOAM Sprint 65
Create a proposal for a generic solution for allowing customers to provide self generated keys, certs, credentials etc to the 3scale Operator and for the subsequent management of those.
We can use these JIRAs as examples of credential uploading that a customer may have:
Redis client tls, Redis acl, DB client tls
Considerations
- The criticality of the secrets
- Should the secrets be watched/reconciled or not
- Are the secrets customer managed or Operator Managed or Blended.
- A blended secret might be one that can be customer managed but if not created by the customer, a default is created by the Operator
- When should a new secret take affect
- Review previous JIRAs related to this area, THREESCALE-10088 and THREESCALE-6735
- Consider the lifecycle of the secrets, what happens when the customer modifies secret or the Operator needs to rotate/modify the secret.
- How do we define the owner of the secret.
- How / where to document secret management for customers - possibly follow on JIRA for this
- Should the Operator report an error that a secret has been updated and is now invalid.
- Should DB secrets be treated different if they are created by the Operator or by the customer.