Add possibilty of owner references to clean up temporary secrets to adr17

the-simmon · the-simmon · commit f87447605417 · 2022-10-05T14:22:03.000+02:00
Signed-off-by: Simon Hülkenberg &lt;simon.huelkenberg@iteratec.com&gt;
diff --git a/docs/adr/adr_0017.md b/docs/adr/adr_0017.md
@@ -124,6 +124,12 @@ spec:
 ```
 </details>
 
+#### Using an initContainer and use ownerReferences for the created secretes
+Using the same initContainer logic described above but setting the ownerReference of the created secrets to the job/pod of the scan would result in similar behavior without the need of a sidecar.
+
+Pros:
+* No need for a sidecar while keeping the namespace clean of temporary secrets
+
 #### Using a separate operator
 Instead of creating the secrets for trivy at scan runtime all secrets could be created upon pod creation. The new proposed operator would not listen on secrets but on pods (not every secret in a namespace is automatically used as an `imagePullSecret` so it doesn't make sense to subscribe to secrets). When a pod gets created the new operator would check if it has `imagePullSecrets` defined and if so it would check if the specific container  was already processed. If not then it would check which `imagePullSecret` belongs to which container and then create the trivy secrets. Similar to the container autodiscovery this new operator would only create a secret for trivy for every distinct secret. When a pod gets updated the new operator will check if the `imagePullSecrets` changed. This approach will clutter the namespace quite substantially because the trivy secrets exist continuously until the secret is not needed anymore (pod that uses the `imagePullSecrets` gets deleted). To be clear: The scheduled scans are still created by the existing autodiscovery. The existing autodiscovery will check if the new operator created a secret for the specific container it wants to scan. If a secret for the container was created the existing autodiscovery would mount this secret. There needs to be a way to tell the existing autodiscovery which pod was processed by the new operator. One could use pod annotations to mark pods as processed (processed := secret was created by the new operator).
 
