You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "villebro (via GitHub)" <gi...@apache.org> on 2026/05/13 01:02:01 UTC
[PR] feat(lifecycle): add secret key rotation task [superset-kubernetes-operator]
villebro opened a new pull request, #51:
URL: https://github.com/apache/superset-kubernetes-operator/pull/51
## Summary
Adds a new "rotate" lifecycle task that runs `superset re-encrypt-secrets` between migrate and init, enabling automated secret key rotation. The task re-encrypts all stored secrets from the old key to the new key.
- New top-level fields `previousSecretKey` (dev) / `previousSecretKeyFrom` (prod) on the parent CRD, with CEL validation for environment mode and mutual exclusivity
- `PREVIOUS_SECRET_KEY` rendered in `superset_config.py` and injected as an env var for all Python components (fallback decryption during transition)
- Presence-based enablement via `spec.lifecycle.rotate: {}` (like clone)
- Checksum-based trigger: re-runs when `secretKeyFrom` / `previousSecretKeyFrom` references change, or when `trigger` field is bumped (for in-place Secret content updates)
- Default `requiresDrain: true` — after re-encryption, stored secrets use the new key and running components with the old key would fail to decrypt
- Pipeline sequence: clone → migrate → **rotate** → init, with full checksum cascade
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(lifecycle): add secret key rotation task [superset-kubernetes-operator]
Posted by "villebro (via GitHub)" <gi...@apache.org>.
villebro merged PR #51:
URL: https://github.com/apache/superset-kubernetes-operator/pull/51
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(lifecycle): add secret key rotation task [superset-kubernetes-operator]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #51:
URL: https://github.com/apache/superset-kubernetes-operator/pull/51#issuecomment-4436174125
## [Codecov](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/51?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `63.75000%` with `29 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 79.98%. Comparing base ([`688881b`](https://app.codecov.io/gh/apache/superset-kubernetes-operator/commit/688881b1872e3a3e6ff65df6c465f29acceeaf04?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`d57bc9f`](https://app.codecov.io/gh/apache/superset-kubernetes-operator/commit/d57bc9fe7f4ffdcd4a6abbc835629bad32364149?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
| [Files with missing lines](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/51?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [internal/controller/lifecycle.go](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/51?src=pr&el=tree&filepath=internal%2Fcontroller%2Flifecycle.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-aW50ZXJuYWwvY29udHJvbGxlci9saWZlY3ljbGUuZ28=) | 56.06% | [21 Missing and 8 partials :warning: ](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/51?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/51?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org