search

bitnami-labs / sealed-secrets

A Kubernetes controller and tool for one-way encrypted Secrets
Apache License 2.0
7.51k stars 675 forks source link

Support unsealing into multiple namespaces #929

Open KlavsKlavsen opened 2 years ago

KlavsKlavsen commented 2 years ago

Which component: Controller

Is your feature request related to a problem? Please describe. We have several containers that needs fetching from a password protected registry - and currently we have to have the SAME secret defined for each namespace we need them in.

We also have other secrets, which we have to duplicate in multiple namespaces

Describe the solution you'd like If we could put multiple namespace targets on 1 secret - that would make life so much easier :)

rowi1de commented 1 year ago

You can try this as a workaround https://github.com/emberstack/kubernetes-reflector but it would be a really helpful feature

ywarezk commented 3 months ago

Just to expand on @rowi1de correct answer.
To use kubernetes-reflector to duplicate your secrets across namespaces, you will need to add the following to SealedSecret manifest:

apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  annotations:
    sealedsecrets.bitnami.com/cluster-wide: 'true'
  creationTimestamp: null
  name: ***
  namespace: default
spec:
  template:
    metadata:
      annotations:
        reflector.v1.k8s.emberstack.com/reflection-allowed: 'true'
        reflector.v1.k8s.emberstack.com/reflection-auto-enabled: 'true'
  encryptedData:
    ***: ***

Notice that we added the spec.template.metadata.annotations to add annotation to the created kind: Secret This will allow the reflector to duplicate the secret

willbush commented 2 months ago

Found this related tool https://config-syncer.com/ (I haven't tried either yet).