Setting Opaque as secret generic default option. #127916

Ritikaa96 · 2024-10-08T07:51:13Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

Adding Opaque as default value for kubectl create secret generic....

Which issue(s) this PR fixes:

Fixes ##127914

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Updated the kubectl help for Secret creation to mention that the default generic secret type is Opaque.

Signed-off-by: Ritikaa96 <[email protected]>

k8s-ci-robot · 2024-10-08T07:51:21Z

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2024-10-08T07:51:34Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Ritikaa96
Once this PR has been reviewed and has the lgtm label, please assign apelisse for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

staging/src/k8s.io/kubectl/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Ritikaa96 · 2024-10-08T07:51:40Z

/sig cli
/area kubectl

k8s-ci-robot · 2024-10-08T08:44:34Z

@Ritikaa96: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-kubernetes-verify	`67d8a35`	link	true	`/test pull-kubernetes-verify`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

ardaguclu · 2024-10-10T11:37:25Z

staging/src/k8s.io/kubectl/pkg/cmd/create/create_secret.go

@@ -131,6 +131,7 @@ type CreateSecretOptions struct {
 // NewSecretOptions creates a new *CreateSecretOptions with default value
 func NewSecretOptions(ioStreams genericiooptions.IOStreams) *CreateSecretOptions {
 	return &CreateSecretOptions{
+		Type: "Opaque",


This field is optional and can be empty. You are changing the default to Opaque which breaks the backward compatibility.

/hold

I don't know if there is some other way this might break backward compatibility, but it looks like an empty type is converted to Opaque as the default, just not by kubectl:

kubernetes/pkg/apis/core/types.go

Lines 6025 to 6026 in a6ea7b8

// SecretTypeOpaque is the default; arbitrary user-defined data

SecretTypeOpaque SecretType = "Opaque"

kubernetes/pkg/apis/core/v1/defaults.go

Lines 283 to 287 in a6ea7b8

func SetDefaults_Secret(obj *v1.Secret) {

if obj.Type == "" {

obj.Type = v1.SecretTypeOpaque

}

}

When I create a secret without specifying --type it creates it as Opaque.

~ $ kubectl create secret generic my-secret --from-literal=foo=bar secret/my-secret created ~ $ k describe secret my-secret Name: my-secret Namespace: default Labels: <none> Annotations: <none> Type: Opaque Data ==== foo: 3 bytes

Interesting. I didn't know that. But in any case, we can't set this explicitly in kubectl because when the default is changed in API level (even if this won't happen), kubectl value will be obsolete.

Hi @mpuckett159 , would like your opinions here as well.
this change was inspired by the comment in another PR: #120337 (comment)

can we instead just add it as a text in the help message. the real target is to mention that there is a default value to the option. However in the discussion mentioned earlier @mpuckett159 mentioned it is better to add it as automatic value to come up when we use kubectl create secret generic --help
WDYT?

@brianpursley @ardaguclu How should we proceed with this? waiting for further discussion.

@brianpursley @ardaguclu How should we proceed with this? waiting for further discussion.

Hey @brianpursley any update for this?

Kubectl isn't the one setting the default when type is unspecified, so I don't think the help text should make an assumption what the server will do.

My concern is that there could be some edge cases where an unspecified type is interpreted differently, and then the help text would be misleading.

sftim · 2024-10-10T12:13:17Z

Changelog suggestion

-Opaque will be seen as defau;t value in the help message for `kubect create secret generic ..`
+Updated the kubectl help for Secret creation to mention that the default generic secret type is Opaque.

k8s-triage-robot · 2025-02-27T17:09:17Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

Ritikaa96 · 2025-02-28T11:01:15Z

/remove-lifecycle stale

Ritikaa96 · 2025-03-26T12:08:12Z

What is the verdict on this PR? Are we waiting for something before we proceed or close this?

brianpursley · 2025-03-29T14:36:48Z

What is the verdict on this PR? Are we waiting for something before we proceed or close this?

As it was mentioned before, it could be a breaking change.

While the server-side may happen to assign a default of "Opaque" based on an unspecified type, if we change kubectl to assign the default it could break people who expect the value not to be set by the client.

If you feel strongly that this should be changed, my recommendation is to either make the case for it on the GitHub issue and/or add it as a topic on the agenda of the bi-weekly SIG-CLI meeting.

k8s-triage-robot · 2025-06-27T15:34:50Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

Setting Opaque as secret generic default option.

67d8a35

Signed-off-by: Ritikaa96 <[email protected]>

k8s-ci-robot requested review from brianpursley and seans3 October 8, 2024 07:51

ardaguclu reviewed Oct 10, 2024

View reviewed changes

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 10, 2024

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 27, 2025

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 28, 2025

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 27, 2025

	// SecretTypeOpaque is the default; arbitrary user-defined data
	SecretTypeOpaque SecretType = "Opaque"

	func SetDefaults_Secret(obj *v1.Secret) {
	if obj.Type == "" {
	obj.Type = v1.SecretTypeOpaque
	}
	}

Setting Opaque as secret generic default option. #127916

Are you sure you want to change the base?

Setting Opaque as secret generic default option. #127916

Conversation

Ritikaa96 commented Oct 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

k8s-ci-robot commented Oct 8, 2024

Uh oh!

k8s-ci-robot commented Oct 8, 2024

Uh oh!

Ritikaa96 commented Oct 8, 2024

Uh oh!

k8s-ci-robot commented Oct 8, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sftim commented Oct 10, 2024

Uh oh!

k8s-triage-robot commented Feb 27, 2025

Uh oh!

Ritikaa96 commented Feb 28, 2025

Uh oh!

Ritikaa96 commented Mar 26, 2025

Uh oh!

brianpursley commented Mar 29, 2025

Uh oh!

k8s-triage-robot commented Jun 27, 2025

Uh oh!

Uh oh!

Ritikaa96 commented Oct 8, 2024 •

edited

Loading