[Proposal] New Secret management in faas-netes

[openfaas]

[Proposal] New Secret management in faas-netes

[alexellis]

I like the level of detail in this proposal - I can tell you've really thought it through. Thank you @LucasRoesler.

As you've found out - the current implementation for Kubernetes secrets in faas-netesd only supports image pull secrets.

Suggestion - could we maintain a list of secrets and then determine the type from the Kubernetes API in order to know where to attach them?

Pseudo code:

spec = new_spec

for secret in requested_secrets
  if k8s_lookup(secret).type == image_pull
     add_image_pull(secret, spec)
  else mount_secret(secret, spec)

Example for the GitHub Protected API sample:

secrets:
 - webhook_secret   # Setup as normal secret
 - internal_registry_1 # Setup as image pull secret (i.e. registry auth) 

webhook_secret would be mounted in the standard location as per Docker Swarm

The internal_registry_1 secret would be mapped as an image pull secret

[LucasRoesler]

I like this proposal by @alexellis, I will work on this tomorrow and hope to have a PR by end of Wednesday

[alexellis]

Please ping me if you need anything.