Deprecate cross-namespace refs and watching multiple namespaces

[squaremo]

Cross-namespace refs won't work with the provided configuration, which gives RBAC permissions for one namespace only. Granting permissions to other namespaces means they are also accessible to the programs run by stacks, which is a security hole.

Therefore: guard the use of api/pulumi/shared/SecretRef.Namespace, and watching >1 (or all) namespaces with WATCH_NAMESPACE, with an environment variable INSECURE_NO_NAMESPACE_ISOLATION. This must be set to 1 or true to enable cross-namespace operation.

This is a breaking change for anyone running the operator with either an empty value, or a comma-separated list (e.g., ns1,ns2 for WATCH_NAMESPACE; and, for anyone using cross-namespace secret references (i.e., with a value in .namespace under one of the fields listed below). The documented means of installing the operator sets WATCH_NAMESPACE to be the namespace in which the operator is deployed.

References in Stack which can be cross-namespace (* indicates there's a list or map):

• .spec.envRefs[*].secret
• .spec.secretRefs[*].secret
• .spec.gitAuth.accessToken.secret
• .spec.gitAuth.sshAuth.sshPrivateKey.secret
• .spec.gitAuth.sshAuth.password.secret
• .spec.gitAuth.basicAuth.userName.secret
• .spec.gitAuth.basicAuth.password.secret

To fix the breakage:

• if you are using a cross-namespace reference, consider using a secret in the same namespace as the Stack object. Kyverno and other such automation can help with syncing secrets across namespaces.
• if you use WATCH_NAMESPACE with an empty value or several values, modify your configuration so that you're running the operator in each namespace where you have Stack objects. (This PR extends the provided Pulumi programs so they will do this for you.)
• If it is not possible to use one of the fixes above, you can enable watching multiple namespaces and cross-namespace references by adding the env entry INSECURE_NO_NAMESPACE_ISOLATION to the operator deployment spec, in the same place as WATCH_NAMESPACES is defined. Be aware that this is really only suitable for "single tenant" clusters -- when you are happy for anyone with access to have access to everything.

[yoyoraso]

Hi, I have a question related to the namespace isolation is it possible to deploy one pulumi operator in one namespace to watch and create stacks across the cluster in all namespaces ?