public_git/postgres-operator
1
0
Fork 0
mirror of https://github.com/zalando/postgres-operator.git synced 2026-10-08 16:57:22 +02:00
Code Issues Projects Releases Wiki Activity

allow users to opt out from globally enabled secret rotation (#2528)

Browse Source 
* allow users to opt out from globally enabled secret rotation
* cover new option also in e2e test
* change ignore test to existing user
This commit is contained in:
Felix Kunde
2024-02-09 12:19:06 +01:00
committed by GitHub
parent 29ea863faf
commit 886cb86797
11 changed files with 81 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/administrator.md
+17
View File
@@ -355,6 +355,23 @@ This would be the recommended option to enable rotation in secrets of database
owners, but only if they are not used as application users for regular read
and write operations.
### Ignore rotation for certain users
If you wish to globally enable password rotation but need certain users to
opt out from it there are two ways. First, you can remove the user from the
manifest's `users` section. The corresponding secret to this user will no
longer be synced by the operator then.
Secondly, if you want the operator to continue syncing the secret (e.g. to
recreate if it got accidentally removed) but cannot allow it being rotated,
add the user to the following list in your manifest:
```
spec:
usersIgnoringSecretRotation:
- bar_user
```
### Turning off password rotation
When password rotation is turned off again the operator will check if the