From 3286b00f58b2d69d4ebb6c6fa28bf1f0374c64ed Mon Sep 17 00:00:00 2001 From: Wojciech Tyczynski Date: Thu, 13 Sep 2018 20:05:24 +0200 Subject: [PATCH] Fix secrets docs in 1.12 branch (#10056) * Fix secrets docs * Update secret.md --- content/en/docs/concepts/configuration/secret.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/configuration/secret.md b/content/en/docs/concepts/configuration/secret.md index 722d0217e1d33..a97cf2c56029c 100644 --- a/content/en/docs/concepts/configuration/secret.md +++ b/content/en/docs/concepts/configuration/secret.md @@ -339,9 +339,15 @@ files. When a secret being already consumed in a volume is updated, projected keys are eventually updated as well. Kubelet is checking whether the mounted secret is fresh on every periodic sync. -However, it is using its local ttl-based cache for getting the current value of the secret. -As a result, the total delay from the moment when the secret is updated to the moment when new keys are -projected to the pod can be as long as kubelet sync period + ttl of secrets cache in kubelet. +However, it is using its local cache for getting the current value of the Secret. +The type of the cache is configurable using the (`ConfigMapAndSecretChangeDetectionStrategy` field in +[KubeletConfiguration struct](https://github.com/kubernetes/kubernetes/blob/{{< param "docsbranch" >}}/pkg/kubelet/apis/kubeletconfig/v1beta1/types.go)). +It can be either propagated via watch (default), ttl-based, or simply redirecting +all requests to directly kube-apiserver. +As a result, the total delay from the moment when the Secret is updated to the moment +when new keys are projected to the Pod can be as long as kubelet sync period + cache +propagation delay, where cache propagation delay depends on the chosen cache type +(it equals to watch propagation delay, ttl of cache, or zero corespondingly). {{< note >}} **Note:** A container using a Secret as a