I’m writing a Kubernetes controller in Go.
Currently, the controller reads tokens from environment variables. The drawback is that it doesn’t detect when the Secret is updated, so it continues using stale values. I’m aware of Reloader, but in this context the controller should handle reloads itself without relying on an external tool.
I see three ways to solve this:
Mount the Secret as files and use inotify to reload when the files change.
Mount the Secret as files and never cache the values in memory; always read from the files when needed.
Provide a Secret reference (secretRef) and have the controller read and watch the Secret via the Kubernetes API. The drawback is that the controller needs read permissions on Secrets.
-…
I’m writing a Kubernetes controller in Go.
Currently, the controller reads tokens from environment variables. The drawback is that it doesn’t detect when the Secret is updated, so it continues using stale values. I’m aware of Reloader, but in this context the controller should handle reloads itself without relying on an external tool.
I see three ways to solve this:
Mount the Secret as files and use inotify to reload when the files change.
Mount the Secret as files and never cache the values in memory; always read from the files when needed.
Provide a Secret reference (secretRef) and have the controller read and watch the Secret via the Kubernetes API. The drawback is that the controller needs read permissions on Secrets.
Q1: How would you solve this?
Q2: Is there a better place to ask questions like this?