fix(server-nestjs): reuse Vault AppRole secret-id instead of minting on every sync - #2626
Draft
shikanime wants to merge 1 commit into
Draft
fix(server-nestjs): reuse Vault AppRole secret-id instead of minting on every sync#2626shikanime wants to merge 1 commit into
shikanime wants to merge 1 commit into
Conversation
shikanime
force-pushed
the
fix/argocd-secret-id-idempotent
branch
2 times, most recently
from
August 28, 2026 14:20
297676a to
e61aa06
Compare
shikanime
commented
Aug 31, 2026
shikanime
left a comment
shikanime
left a comment
Member
Author
There was a problem hiding this comment.
Verdict : Changements demandés — conflit de fusion + gardes déjà sur main (PR propriétaire : commentaire, non request-changes).
- mergeable=CONFLICTING — [🔴 Bloquant] La PR cible
mainmais re-implémenteisVaultNotFound/isVaultBadRequest/isNexusNotFound/isGitbeakerUnauthorizedqui y sont déjà (commitec9c18a914). Le conflit porte précisément survault.utils.ts,nexus.utils.ts,gitlab.utils.ts. Rebasez surmain: gardez uniquementgenerateAppRoleSecretIdPath+ la logique get-or-create deensureAuthApproleRoleSecretId. - vault-client.service.ts:401-456 — [✨ Éloge] Le get-or-create du secret-id AppRole (relit le KV
APPROLE_SECRET_ID, réutilise si présent, sinon mint + persiste) résout exactement #2622 : plus de nouveau commitvalues.yamlà chaque sync. Tests first/second-sync bien couverts. - argocd.service.ts:405 + spec — [🟢 Conforme] Le renommage
createAuthApproleRoleSecretId→ensureAuthApproleRoleSecretIdest cohérent partout (service + 5 mocks de spec).
Corrigez le conflit par un rebase sur main avant fusion.
…on every sync Refs #2622 Co-authored-by: Automata <automata@shikanime.studio> Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr> Change-Id: Ie3d3b7df1e0539c02d6a215ce7eff82a6a6a6964
shikanime
force-pushed
the
fix/argocd-secret-id-idempotent
branch
from
August 31, 2026 11:44
e61aa06 to
f8f16bd
Compare
|
0 New Issues
0 Fixed Issues
0 Accepted Issues
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issues liées
Quel est le comportement actuel ?
À chaque synchronisation (project.upsert, cron),
generateVaultValuesappellecreateAuthApproleRoleSecretId, qui émet un nouveau secret-id AppRole viaPOST auth/approle/role/{role}/secret-id. Le secret-id n'est ni relu ni réutilisé : il s'accumule dans Vault à chaque exécution, et son renouvellement systématique rend la diff de contenu desvaluestoujours sale, d'où un nouveau commitvalues.yamlà chaque passage même sans changement de configuration.Comportement attendu
Le secret-id est idempotent : une seconde synchronisation sans changement de configuration ne produit ni nouveau secret-id ni nouveau commit
values.yaml. Le role-id continue d'être relu via GET (chemin inchangé).Changements
createAuthApproleRoleSecretIddevient un get-or-create : il relit un secret-id persisté dans le KV Vault du projet ; s'il existe, il le réutilise, sinon il le crée puis le persiste.APPROLE_SECRET_ID(aux côtés des autres identifiants du projet).