search

kiwigrid / secret-replicator

11 stars 4 forks source link

add option to replicate only to defined namespaces #9

Open monotek opened 4 years ago

monotek commented 4 years ago

currently only exclude is possible which means you need to know all namespaces you want to have excluded.

a new env var NAMESPACE_INCLUDE should be available. default should be "all".

kfox1111 commented 4 years ago

+1. Was going to ask the same thing.

I've been running clusters where I have a user namespace <project> and a supporting namespace we manage for the user <project>-admin. I'd like to sync secrets managed in the <project>-admin namespace (cert-manager generated/managed) into the <project> namespace. So I'd need a way to specify just the namespace I want it to go into.

rpahli commented 4 years ago

wolud it also be an option to add an annotation to a single secret with the list of namespaces? I'm currently thinking how to solve it and also be flexible.

kfox1111 commented 4 years ago

That could be another option, but does run into problems with cert-manager specifically: https://github.com/jetstack/cert-manager/issues/2576

rpahli commented 4 years ago

ok I will think about it. Thank's for your answer.

monotek commented 4 years ago

@rpahli Ping :)

monotek commented 4 years ago

@kfox1111 you maybe could use kubed (https://github.com/appscode/kubed) as a workaround

kfox1111 commented 4 years ago

@monotek, no it won't work. See referenced issue above.

TL;DR I want to place a Cert-Manager Certificate request in a namespace called -admin where we manage stuff on behalf of users. In there is an ingress-nginx running in there that watches namespace . In single namespace mode, ingress-nginx only watches for tls certificates in that namespace and cert-manager will only create certificate secrets in the same namespace as the certificate object. What this means, is I need a way of syncing a secret from one namespace to another. In addition, cert-manager doesn't support annotating/labeling secrets it creates. So Kubed wont work as it must have labels.

Secret-replicator will just about work, but only needs to sync from -admin to , not to every other namespace.

kfox1111 commented 4 years ago

Looks like this may be implemented already? https://github.com/kiwigrid/secret-replicator/commit/cacb280b725192249dfb9881a665307905c580cf

Is there a plan to cut a new release soon with this in place?

Thanks! Kevin

kfox1111 commented 4 years ago

Actually, I hit another snag. This only looks to be able to run across all namespaces. I'd be wanting to use it to watch one namespace and syncronize into a second namespace and have multiple instances of secret-replicator running in parallel looking at nonoverlapping namespaces.