nabsul
commented
4 years ago Hi Scott,
I had the same question a few weeks ago. The answer is in this section of the Kubernetes docs: https://kubernetes.io/docs/concepts/configuration/secret/#restrictions
Secrets can only be referenced by Pods in that same namespace.
However, this is a great feature idea, and so that I don't forget this is how I would change the tool:
- Add the ability to specify more than one namespace to push the same docker secret to
- Add the ability to look up all namespaces dynamically and push the secret to all of them
If you'd like to take on this feature let me know and I'll wait for a pull request. Otherwise, I should be able to find time to implement it in the next couple of weeks.
In the meantime, here's some useful information if you need to get yourself unblocked quicker:
1) You can use a ClusterRole instead of a regular Role when setting up a service account. This will give the pod/cronjob access to all namespaces instead of just one.
And you would need to do one of these two:
2.a) You can deploy k8c-ecr-login-renew cron jobs in each namespace that needs the docker secret.
2.b) Use kubectl to copy one secret to all the other namespaces. You can even create a cron job so that it runs automatically in your cluster.
Personally, I think 2.b is the more "elegant" solution, though it would require a bit more work. "2.a" should be fine if you only have a few namespaces.
Either way, hopefully you won't need either of the above in a couple of weeks.
Cheers.
Q-Nimbus
Hi Thank you for the great work on this
I have a query not a bug, I have found that I can only deploy images from the docker registry to the namespace where I deployed the ecr-login-renew
Is it possible to allow this to access multiple namespaces? if so how, apologies for the what is possibly just me not understanding how the permissions work.
Kind Regards,
Scott