Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Kustomize defined secrets is not used by OnionService::privateKeySecret #86

Open
alf0ns3 opened this issue Jan 22, 2025 · 0 comments
Labels
bug Something isn't working

Comments

@alf0ns3
Copy link

alf0ns3 commented Jan 22, 2025

Describe the bug
When importing a privateKeySecret generated by Kustomize on a new OnionService, the controller creates a new secret based on the name provided and so the hostname is random.
It is due to Kustomize which append a suffix hash to the secret name, while the Tor Controller is not aware of the new name.

To Reproduce

# kustomization.yaml
namespace: test

secretGenerator:
  - name: onion-secrets
    type: "tor.k8s.torproject.org/onion-v3"
    files:
      - privateKeyFile=secrets/hs_ed25519_secret_key
      - publicKeyFile=secrets/hs_ed25519_public_key
      - onionAddress=secrets/hostname

#generatorOptions:
#  disableNameSuffixHash: true

resources:
  - onion-service.yaml
  - deployment.yaml # definition of the http-app



# onion-service.yaml
---
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
  name: onion-service
spec:
  version: 3
  rules:
    - port:
        number: 80
      backend:
        service:
          name: http-app
          port:
            number: 80
  privateKeySecret:
    name: onion-secrets

The Tor Controller creates the secret onion-secrets with 5 entries (Tor v2&v3), while Kustomize creates the desired secrets onion-secrets-52gc9c9ccd.

kubectl -n test get secrets
onion-secrets              tor.k8s.torproject.org/onion-v3                5      15m
onion-secrets-52gc9c9ccd   tor.k8s.torproject.org/onion-v3                3      14m

By using the Kustomize disableNameSuffixHash config, it is woking as expected, such as using the hashed name on the OnionService definition.

Expected behavior

When using a Kustomize defined secret, the Tor Controller should use it automatically with the suffix hash.

Additional information

System (please complete the following information):

  • Platform: minikube v1.34.0
  • Version: master branch ( aae11b5 )

Additional context

@alf0ns3 alf0ns3 added the bug Something isn't working label Jan 22, 2025
@alf0ns3 alf0ns3 changed the title [BUG] title [BUG] Kustomize defined secrets is not used by OnionService::privateKeySecret Jan 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant