It’s Cybersecurity Awareness Month! Join our interactive training session, or learn about security and AI from 1Password experts.
Forum Discussion
OnePasswordItem status stays empty
Hi, I set up a connect-server and "installed" operator into a GKE based cluster. I can successfully create secrets from items in my vault via terraform, however, there are a few thing that I wish would be implemented.
In this question I would like to focus only on one of those: observability of status of a OnePasswordItem.
When I query details of a created OnePasswordItem I can see:
apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
creationTimestamp: "2022-03-17T08:41:25Z"
finalizers:
- onepassword.com/finalizer.secret
generation: 2
name: secret-properties
namespace: oauth2-develop
resourceVersion: "911495"
uid: 052ef8a6-5da1-4e32-977e-9073872a217a
spec:
itemPath: <redacted>
status: {}
type: Opaque
My problem is that status contains nothing. This is an issue, cause I'm using terraform like:
resource "kubernetes_manifest" "oauth_secret_properties" {
manifest = {
apiVersion = "onepassword.com/v1"
kind = "OnePasswordItem"
metadata = {
name = "secret-properties"
namespace = kubernetes_namespace.oauth2.metadata[0].name
}
type = "Opaque"
spec = {
itemPath = <redacted>
}
}
}
and I would like to be able to add a https://registry.terraform.io/providers/hashicorp/kubernetes/2.6.1/docs/resources/manifest#using-wait_for-to-block-create-and-update-calls block in kubernetes_manifest so terraform can figure out when is it safe to move on to the next resource creation (which actually depends on this existing secret).
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
9 Replies
That's good to hear. When it's released will depend on how quickly we can iron out the API. There is still some discussion on the
readyfield.I am currently leaning towards removing that altogether. Is it correct that the following would work for you?
resource "kubernetes_manifest" "oauth_secret_properties" {
manifest = {
apiVersion = "onepassword.com/v1"
kind = "OnePasswordItem"
metadata = {
name = "secret-properties"
namespace = kubernetes_namespace.oauth2.metadata[0].name
}
type = "Opaque"
spec = {
itemPath = <redacted>
}
}
wait {
fields = {
"status.conditions[0].type" = "Ready"
"status.conditions[0].status" = "True"
}
}
}
I tested this locally and it seems to do what you would expect: it waits for the k8s secret to be created.
