Scoping with ExternalSecret config might be broken #718

ghost · 2021-04-23T16:03:48Z

ghost
Apr 23, 2021

Hi folks, I have an intention to implement scoping using newly introduced ExternalSecret config capability with instance ID and controller ID, but unfortunately it does not work for me. I definitely created ad instance with a proper instanceID:

/app $ node
Welcome to Node.js v12.22.1.
Type ".help" for more information.
> process.env.INSTANCE_ID
'finance'

I've created a simple external secret manifest like

apiVersion: kubernetes-client.io/v1
kind: ExternalSecret
metadata:
  name: testsm
spec:
  controllerId: "finance"
  backendType: secretsManager
  data:
    - key: finance/password
      name: password

I've set up all the necessary AWS policies and roles to get this working and it works ok without specifying instance ID and controller ID, but with these both I got the following message in logs after bumping up log level to debug
the secret default/testsm is not managed by this instance but by finance
which surprised me a lot.

Then I made some deep dive into the code base and found some part of the code which I do not fully understand. So, in lib/daemon.js constructor expects instanceId as an input (Line 14). But in bin/daemon.js (Line 63) daemon object is initializing without passing instanceId. I am not super strong in Java Script, so I am not sure if this is an issue, but it looks to me that my controller still has its instanceId equal to empty string which causes a condition to be always true despite what is in process.env.INSTANCE_ID

@Flydiverny I really appreciate any suggestions as my team is going to use kes in our new project and we would like to use this perfect scoping for production.