[RFC-XXXX] Vendor-Agnostic Short-Lived Credentials - #5702
Conversation
matheuscscp
added
enhancement
87c0172 to
e2a8a56
Compare
4adaa54 to
635872b
Compare
| short-lived credential to use for authentication. The field is mutually exclusive | ||
| with `.spec.provider` (when set to a cloud provider) because "provider" conveys |
There was a problem hiding this comment.
Should we provide another CEL rule example for this? Given "mutual exclusivity".
There was a problem hiding this comment.
Not sure I follow the suggestion 🤔
There was a problem hiding this comment.
I think the current CEL expression already covers the entire mutual exclusivity, no? 🤔
f9632fd to
792631f
Compare
|
@hiddeco I fixed the inconsistencies you found around the SPIFFE flags in this diff: https://github.com/fluxcd/flux2/compare/f9632fd9d7c118763ba7bfbd2e88cbe8a9dbf8e3..792631f49699aa8813cc24f2875f3a75fe1a826c They were an artifact of my late decision to introduce a separate flag for the trust domain. |
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
792631f to
6fcba05
Compare
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
|
@stefanprodan @hiddeco @stealthybox The last week to work on |
|
As explained here: #5702 (comment) The SPIFFE integration currently described in this proposal is stale. This RFC will soon undergo lots of changes. Also, this RFC is delayed to Flux 2.10 (planned for somewhere in Q4), and it will be the main topic of the release. The Flux 2.9 release is unfortunately coming very soon: we will start releasing the controllers on June 15. Flux 2.9 is also very stuffed and even if we had more time we decided not to ship more things, otherwise the time we planned for dealing with fallouts and bugs after the release will not be enough and we will compromise other things in our calendars. cc @vicaya |
|
SPIFFE merged the Broker API today! |
6 participants
Closes: #5681
Preview: https://github.com/fluxcd/flux2/blob/rfc-creds/rfcs/xxxx-vendor-agnostic-short-lived-credentials/README.md
@SpectralHiss Please review 🙏