Trigger from CloudWatch Events -> SNS topic or Lambda rather than polling

[whereisaaron]

Polling every external secret seems like a lot of unnecessary transactions.

SSM will tell you when a secret is updated via a CloudWatch Event. That event can either:

1. Pass the event to an SNS topic, which kubernetes-external-secrets is subscribed to
2. Pass the event to a Lambda function that could make a webhook call to a kubernetes-exernal-event endpoint.

kubernetes-external-secretswould still poll on start-up, and maybe once every hour or two, just in case.

[silasbw]

This sounds great. We'd ❤️ a PR :)

[cep21]

Slightly related to this, is it possible to trigger refreshes on a webhook of the service? Then I could set my poll interval really high and do the SNS topic stuff out of band. (It's unclear if SNS subscription needs to be core to the project since a webhook is enough).

[Flydiverny]

Currently no webhook available but I think it would make sense to add one in some way. Not sure how it should be specified tho.
Should it just be really basic and trigger a repoll of everything or should you specify the secret (KES resource) to trigger polling for that specific one

[cep21]

Should it just be really basic and trigger a repoll of everything or should you specify the secret (KES resource) to trigger polling for that specific one

Either is fine. The best catch all solution would be a "refresh everything" webhook (also easiest to trigger since you just hit an endpoint and don't care about HTTP body formatting). Honestly secrets update so rarely that it would probably be just fine. It could later be extended to support specific secrets.

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 30 days.

[cep21]

/notstale

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 30 days.

[cep21]

Nostale

[Flydiverny]

I don't think this is something we'll include in KES and I think it would be better to start a discussion and possible contribution in the go rewrite https://github.com/external-secrets/external-secrets